CVE-2026-52992: fs/adfs: validate nzones in adfs_validate_bblk()
In the Linux kernel, the following vulnerability has been resolved:
fs/adfs: validate nzones in adfsvalidatebblk()
Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used.
When nzones is 0, adfsreadmap() passes it to kmallocarray(0, ...) which returns ZEROSIZEPTR, and adfsmaplayout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer.
adfsvalidatedr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfsvalidatebblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time.
Found by syzkaller.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update fs/adfs so adfs_validate_bblk() performs an equivalent validation to reject ADFS disc records with a zero zone count (nzones == 0) before the disc record is used (probe-time validation for boot block).
Linux kernel (fs/adfs) adfs_validate_bblk() nzones validation = Reject disc records where nzones == 0 during boot block probe/validation