CVE-2026-97926

Reference list NVD curates from the CNA record, vendor advisories, and third-party reports. The tag chips below are NVD's analyst-assigned categories.

• https://git.kernel.org/stable/c/5902a95066883cf96fa15b2680694fc5dd0c7d11 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/87b12dc360a002eb2d498aa4f01e84347019612d 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/abde9eb33106850dfa367ad3965d3588bb8558d5 416baaa9-dc9f-4396-8d5f-8c081fb06d67
• https://git.kernel.org/stable/c/c9d263be26806d388129fab8c6904bed197fc6af 416baaa9-dc9f-4396-8d5f-8c081fb06d67

The full cvelistV5 record. Download as CVE-2026-97926.json.

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ufs/cylinder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "5902a95066883cf96fa15b2680694fc5dd0c7d11",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "87b12dc360a002eb2d498aa4f01e84347019612d",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "abde9eb33106850dfa367ad3965d3588bb8558d5",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            },
            {
              "lessThan": "c9d263be26806d388129fab8c6904bed197fc6af",
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ufs/cylinder.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "lessThan": "2.6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.111",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.53",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.7",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc3",
                  "versionStartIncluding": "2.6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nufs: validate cylinder group metadata before caching it\n\nufs_read_cylinder() copies the cylinder group index and the rotor\npositions straight from the on-disk group and caches them without any\ncheck:\n\n\tucpi->c_cgx    = fs32_to_cpu(sb, ucg->cg_cgx);\n\tucpi->c_rotor  = fs32_to_cpu(sb, ucg->cg_rotor);\n\tucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor);\n\tucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor);\n\nThey are then used as indices during allocation and free:\n\n  - c_cgx indexes the cylinder summary array as\n    UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32\n    bit count outside the s_csp allocation.\n\n  - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and\n    then length = ((s_fpg + 7) >> 3) - start. A start beyond the block\n    bitmap wraps the unsigned length to a huge value, so ubh_scanc()\n    walks far past the cylinder group buffers. c_irotor drives the\n    inode bitmap the same way.\n\nA crafted image can set any of these freely, turning an ordinary\nallocation into an out of bounds access.\n\nReject a cylinder group whose recorded index does not match the group\nbeing read, or whose rotors fall outside the group, before the metadata\nis cached. Valid filesystems keep cg_cgx equal to the group number and\nthe rotors within the group, so only malformed images are rejected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The bad cg_cgx/cg_rotor/cg_frotor/cg_irotor values come from a crafted UFS image's cylinder group block, read by ufs_read_cylinder(). They are then used by the local VFS allocate/free paths (ufs_new_fragments, ufs_free_fragments, ufs_new_inode, ufs_free_inode). No network protocol carries these bytes.\nAC:H - ufs_load_cylinder() is called only from the allocate/free paths in balloc.c and ialloc.c. These need a read-write mount, and ufs_fill_super() returns -EROFS for one unless the non-default CONFIG_UFS_FS_WRITE (\"DANGEROUS\") is set. Major distros leave it off and only a few MIPS defconfigs set it, so reaching the bug depends on a rare kernel config.\nPR:N - The attacker only has to craft the image. The ufs file_system_type sets FS_REQUIRES_DEV without FS_USERNS_MOUNT, so the mount is done by a privileged victim, not the attacker. After that, creating or extending a file triggers the allocation.\nUI:R - A victim has to mount the attacker-supplied UFS image read-write before ufs_read_cylinder() caches the malformed cylinder group fields.\nS:U - The out-of-bounds accesses stay in kernel heap memory in the same kernel security authority. No guest/host or hardware boundary is crossed.\nC:H - If c_frotor/c_irotor lie outside the group, the unsigned length in ufs_bitmap_search() wraps. ubh_scanc() then reads far past the cylinder group buffers, an unbounded out-of-bounds read of kernel memory.\nI:H - ufs_add_fragments()/ufs_free_* call fs32_add() on UFS_SB(sb)->fs_cs(ucpi->c_cgx). An attacker-chosen c_cgx beyond s_ncg adds to a 32-bit value outside the s_csp heap allocation, an out-of-bounds heap write at a chosen index.\nA:H - The wild ubh_scanc() walk and the out-of-bounds fs_cs() writes can oops the kernel or corrupt the heap, crashing the system."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-25T14:41:38.420Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/5902a95066883cf96fa15b2680694fc5dd0c7d11"
        },
        {
          "url": "https://git.kernel.org/stable/c/87b12dc360a002eb2d498aa4f01e84347019612d"
        },
        {
          "url": "https://git.kernel.org/stable/c/abde9eb33106850dfa367ad3965d3588bb8558d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/c9d263be26806d388129fab8c6904bed197fc6af"
        }
      ],
      "title": "ufs: validate cylinder group metadata before caching it",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-97926",
    "datePublished": "2026-09-25T10:22:44.197Z",
    "dateReserved": "2026-09-25T10:18:58.203Z",
    "dateUpdated": "2026-09-25T14:41:38.420Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}