CVE-2026-97926

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ufs: validate cylinder group metadata before caching it

ufs_read_cylinder() copies the cylinder group index and the rotor

positions straight from the on-disk group and caches them without any

check:

ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx);

ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor);

ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor);

ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor);

They are then used as indices during allocation and free:

- c_cgx indexes the cylinder summary array as

UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32

bit count outside the s_csp allocation.

- c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and

then length = ((s_fpg + 7) >> 3) - start. A start beyond the block

bitmap wraps the unsigned length to a huge value, so ubh_scanc()

walks far past the cylinder group buffers. c_irotor drives the

inode bitmap the same way.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References