All vulnerabilities
CVE-2026-97926

Linux: ufs: validate cylinder group metadata before caching it

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
7.0High
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.15%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in88cccb6beba136b73f0caf80e59457e1b3c0ca1eAlso 58c0c414b2b8d099d33da494a354fa836ca6c10b, 5902a95066883cf96fa15b2680694fc5dd0c7d11 and 1 moreCVE List
Published25 Sep 2026Updated 19 Oct 2026CVE List

What fixes it

  • 88cccb6beba136b73f0caf80e59457e1b3c0ca1eLinuxCVE List
  • 58c0c414b2b8d099d33da494a354fa836ca6c10bLinuxCVE List
  • 5902a95066883cf96fa15b2680694fc5dd0c7d11LinuxCVE List
  • 87b12dc360a002eb2d498aa4f01e84347019612dLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

ufs: validate cylinder group metadata before caching it

ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check:

ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor); ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor);

They are then used as indices during allocation and free:

  • c_cgx indexes the cylinder summary array as

UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32 bit count outside the s_csp allocation.

  • c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and

then length = ((s_fpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubh_scanc() walks far past the cylinder group buffers. c_irotor drives the inode bitmap the same way.

A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access.

Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cg_cgx equal to the group number and the rotors within the group, so only malformed images are rejected.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 88cccb6beba136b73f0caf80e59457e1b3c0ca1eCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f560a9e33365c460827c735fd86435f9213f1aedCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before e4c5cc9688c3e69d07d888853388549ae26c0521CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 58c0c414b2b8d099d33da494a354fa836ca6c10bCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 5902a95066883cf96fa15b2680694fc5dd0c7d11CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 87b12dc360a002eb2d498aa4f01e84347019612dCVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before abde9eb33106850dfa367ad3965d3588bb8558d5CVE List
  • Linuxaffected: 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before c9d263be26806d388129fab8c6904bed197fc6afCVE List
  • Linuxaffected: 2.6.12CVE List
  • Linuxunaffected: all versions before 2.6.12CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.111 through 6.12.*CVE List
  • Linuxunaffected: 6.18.53 through 6.18.*CVE List
  • Linuxunaffected: 7.2.7 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8