CVE-2026-97927: ufs: create the root dentry after loading cylinder metadata
In the Linux kernel, the following vulnerability has been resolved:
ufs: create the root dentry after loading cylinder metadata
ufsfillsuper() installed sb->sroot before it loaded the cylinder group structures for a writable mount:
sb->sroot = dmakeroot(inode); ... if (!sbrdonly(sb)) if (!ufsreadcylinderstructures(sb)) goto failed;
When ufsreadcylinderstructures() failed, the error path freed the in-core superblock information and set sb->sfsinfo to NULL while sb->sroot stayed installed. gettreebdev() then reached deactivatelockedsuper(), and because sroot was present, genericshutdownsuper() called syncfilesystem() and the putsuper operation. Both dereference UFSSB(sb), which is now NULL, so a mount that fails only while reading the cylinder groups oopses during teardown. A crafted image whose first cylinder group cannot be read reaches this path.
Load the cylinder group metadata first and create the root dentry last, so the superblock is published to the VFS only once it is fully set up. ufssetupcstotal() and ufsreadcylinderstructures() take only the superblock and do not use the root inode, so the reordering is safe.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this failure path?
Systems that attempt a writable mount of a UFS filesystem are exposed if the cylinder group metadata cannot be read. A crafted UFS image with an unreadable first cylinder group can trigger it.
What does an attacker need to trigger the issue?
They need to cause the system to mount a crafted UFS image such that reading the first cylinder group fails. The described outcome is a kernel oops during mount teardown.
Are read-only UFS mounts affected?
The vulnerable cylinder-structure loading path is performed only when the filesystem is not mounted read-only. The described failure therefore applies to writable mounts.
How can administrators identify an affected event?
An affected event occurs when a writable UFS mount fails while reading cylinder group structures, followed by teardown through generic_shutdown_super(), sync_filesystem(), and the UFS put_super operation dereferencing a NULL UFS superblock pointer.