A memory safety flaw in the Linux kernel UBIFS driver could allow an unauthenticated local attacker to trigger an out-of-bounds read and cause a system crash or information disclosure.

The vulnerability resides in ubifs_sb_verify_signature where an incorrect sign check on the ubifs_sig_node->len field allows an inflated length to be processed. This results in an out-of-bounds read when mounting a crafted UBIFS image, as the system attempts to parse data beyond the allocated buffer.

The flaw carries a CVSS score of 7.7, reflecting its potential for significant impact on system availability and data confidentiality. An attacker with local access could leverage a specially crafted filesystem image to trigger a kernel panic, resulting in denial of service, or potentially leak sensitive information stored in kernel memory. Given the critical nature of the kernel, this vulnerability poses a high risk to systems utilizing UBIFS for storage.

Immediate Action: Update the Linux kernel to version 5.10.270, 5.15.221, 6.1.188, 6.6.157, or newer to include the security fix.

Proactive Monitoring: Monitor system logs for kernel oops or unexpected filesystem mounting errors, which may indicate an attempt to exploit this vulnerability.

Compensating Controls: Restrict physical or local access to systems utilizing UBIFS formatted partitions to untrusted users, as the attack vector requires the ability to mount a malicious filesystem.

Public Exploit Available: Unknown.

This vulnerability represents a significant risk to the integrity and availability of Linux-based systems. Administrators should prioritize patching the kernel across all affected environments as part of the next scheduled maintenance window. Applying the provided updates is the only definitive way to mitigate the risk of local exploitation.