CVE-2026-97926: ufs: validate cylinder group metadata before caching it
In the Linux kernel, the following vulnerability has been resolved:
ufs: validate cylinder group metadata before caching it
ufsreadcylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check:
ucpi->ccgx = fs32tocpu(sb, ucg->cgcgx); ucpi->crotor = fs32tocpu(sb, ucg->cgrotor); ucpi->cfrotor = fs32tocpu(sb, ucg->cgfrotor); ucpi->cirotor = fs32tocpu(sb, ucg->cgirotor);
They are then used as indices during allocation and free:
- ccgx indexes the cylinder summary array as UFSSB(sb)->fscs(ucpi->ccgx), so a value past sncg writes a 32 bit count outside the scsp allocation.
- cfrotor becomes a bitmap scan start, start = cfrotor >> 3, and then length = ((sfpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubhscanc() walks far past the cylinder group buffers. cirotor drives the inode bitmap the same way.
A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access.
Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cgcgx equal to the group number and the rotors within the group, so only malformed images are rejected.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Before caching UFS cylinder-group metadata, reject any group whose recorded cg_cgx does not match the group number or whose c_frotor, c_irotor, or c_rotor falls outside the cylinder group.
Event History
Frequently Asked Questions
What must an attacker control to trigger the vulnerable paths?
The attacker needs to provide a crafted UFS filesystem image containing cylinder-group metadata with an invalid recorded group index or out-of-range rotor positions. The affected fields are c_cgx, c_rotor, c_frotor, and c_irotor.
When can malformed metadata lead to memory access outside expected bounds?
A mismatched c_cgx can cause a write beyond the cylinder-summary allocation. Out-of-range free-block or inode rotor values can make bitmap scan lengths wrap and cause scanning beyond the cylinder-group buffers during allocation or free operations.