UBUNTU-CVE-2026-124746: Integer Overflow
A flaw was found in BusyBox. An integer overflow occurs in the volumeid component when calculating buffer boundaries while probing filesystem metadata. An attacker can exploit this vulnerability by providing a specially crafted filesystem image on an attached storage device. When probed by utilities such as blkid, findfs, or mount, the application crashes, resulting in a Denial of Service (DoS) that prevents the system from resolving or mounting storage devices.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems using Ubuntu's BusyBox utilities to probe filesystem metadata are exposed when they process attacker-controlled or untrusted attached storage devices or filesystem images.
What does an attacker need to exploit it?
An attacker needs to provide a specially crafted filesystem image on an attached storage device and have it probed by a utility such as blkid, findfs, or mount.
Is the impact limited to a crash?
The described impact is denial of service: the affected application can crash, preventing the system from resolving or mounting storage devices.