CVE-2026-97926ufs: validate cylinder group metadata before caching it
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor); ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor); They are then used as indices during allocation and free: - c_cgx indexes the cylinder summary array as UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32 bit count outside the s_csp allocation. - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and then length = ((s_fpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubh_scanc() walks far past the cylinder group buffers. c_irotor drives the inode bitmap the same way. A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access. Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cg_cgx equal to the group number and the rotors within the group, so only malformed images are rejected.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 3, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 88cccb6beba136b73f0caf80e59457e1b3c0ca1e; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f560a9e33365c460827c735fd86435f9213f1aed; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e4c5cc9688c3e69d07d888853388549ae26c0521; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 58c0c414b2b8d099d33da494a354fa836ca6c10b; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5902a95066883cf96fa15b2680694fc5dd0c7d11; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 87b12dc360a002eb2d498aa4f01e84347019612d; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before abde9eb33106850dfa367ad3965d3588bb8558d5; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c9d263be26806d388129fab8c6904bed197fc6af | CNA record |
References
- https://git.kernel.org/stable/c/88cccb6beba136b73f0caf80e59457e1b3c0ca1e
- https://git.kernel.org/stable/c/f560a9e33365c460827c735fd86435f9213f1aed
- https://git.kernel.org/stable/c/e4c5cc9688c3e69d07d888853388549ae26c0521
- https://git.kernel.org/stable/c/58c0c414b2b8d099d33da494a354fa836ca6c10b
- https://git.kernel.org/stable/c/5902a95066883cf96fa15b2680694fc5dd0c7d11
- https://git.kernel.org/stable/c/87b12dc360a002eb2d498aa4f01e84347019612d
- https://git.kernel.org/stable/c/abde9eb33106850dfa367ad3965d3588bb8558d5
- https://git.kernel.org/stable/c/c9d263be26806d388129fab8c6904bed197fc6af
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.