CVE-2026-72369

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

minix: avoid overflow in bitmap block count calculation

minix_check_superblock() uses minix_blocks_needed() to verify that the

on-disk imap and zmap block counts are large enough for the advertised

inode and zone counts.

The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.

A Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the

addition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap

block count look valid, after which minix_fill_super() can dereference

s_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.

Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is

near UINT_MAX makes minix_check_superblock() accept a zero bitmap-block

count and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking

the kernel.

The divisor is the bitmap capacity in bits, blocksize * 8, which is

always a power of two: minix_fill_super() obtains the bl

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References