Linux Kernel CVE-2026-46094

The vulnerability is in ext4's on-disk extended-attribute validation routine check_xattrs() (fs/ext4/xattr.c). Extended attributes are key/value metadata stored either inline in the inode or in a dedicated xattr block. While iterating xattr entries, the loop guards the next entry with '(void *)next >= end', which permits 'next' to sit within sizeof(u32) bytes of the buffer end. On the following iteration the IS_LAST_ENTRY() macro dereferences '*(__u32 *)(entry)' - a 4-byte read - so when 'next' lands at end-1 the check still passes (next < end) but the read accesses 3 bytes past the valid region. This is a classic CWE-125 (Out-of-bounds Read) caused by an off-by-(sizeof(u32)) boundary condition; the fix tightens the test to '(void *)next + sizeof(u32) > end' so a full 4-byte read always fits. The CPE data scopes this to the Linux kernel operating system (cpe:2.3:o:linux:linux_kernel), and the regression was introduced around the ext4 xattr handling present since kernel 6.3.