Vulnerability in Linux

[ Description ]Official description

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor); ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor); They are then used as indices during allocation and free: - c_cgx indexes the cylinder summary array as UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32 bit count outside the s_csp allocation. - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and then length = ((s_fpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubh_scanc() walks far past the cylinder group buffers. c_irotor drives the inode bitmap the same way. A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access. Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cg_cgx equal to the group number and the rotors within the group, so only malformed images are rejected.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• CERT-FR9 Oct 2026CERTFR-2026-AVI-1289

  Multiple vulnerabilities in the Debian LTS Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian LTS Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1311 more CVEs
• CERT-FR2 Oct 2026CERTFR-2026-AVI-1253

  Multiple vulnerabilities in the Debian Linux kernel Translated from French

  Multiple vulnerabilities have been discovered in the Debian Linux kernel. Some of them allow an attacker to cause privilege escalation, a breach of data confidentiality and denial of service.

  CVE-2025-38237CVE-2025-39833CVE-2025-39925+1310 more CVEs
• BSI CERT-Bund24 Sep 2026WID-SEC-2026-3579

  Linux Kernel: Multiple vulnerabilities Translated from German

  CVE-2026-97615CVE-2026-97978CVE-2026-98127+590 more CVEs

[ References ]References

• git.kernel.org/stable/c/58c0c414b2b8d099d33da494a354fa836ca6c10b
• git.kernel.org/stable/c/5902a95066883cf96fa15b2680694fc5dd0c7d11
• git.kernel.org/stable/c/87b12dc360a002eb2d498aa4f01e84347019612d
• git.kernel.org/stable/c/88cccb6beba136b73f0caf80e59457e1b3c0ca1e
• git.kernel.org/stable/c/abde9eb33106850dfa367ad3965d3588bb8558d5
• git.kernel.org/stable/c/c9d263be26806d388129fab8c6904bed197fc6af
• git.kernel.org/stable/c/e4c5cc9688c3e69d07d888853388549ae26c0521
• git.kernel.org/stable/c/f560a9e33365c460827c735fd86435f9213f1aed