PT-2026-51886 · Linux · Linux

Publicado 2026-06-24 · Atualizado 2026-06-24 · CVE-2026-52992

Mitre

In the Linux kernel, the following vulnerability has been resolved:

fs/adfs: validate nzones in adfs validate bblk()

Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used.

When nzones is 0, adfs read map() passes it to kmalloc array(0, ...) which returns ZERO SIZE PTR, and adfs map layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer.

adfs validate dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs validate bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time.

Found by syzkaller.

Identificadores relacionados

CVE-2026-52992

Produtos afetados

Linux

Referências · 9

• https://git.kernel.org/stable/c/6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebc · Nota
• https://git.kernel.org/stable/c/1f0ed0f57f0fc87e46fe19a05435c214dc464be2 · Nota
• https://git.kernel.org/stable/c/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d · Nota
• https://git.kernel.org/stable/c/a3fd5dc1c7b0aae947a67dc2e2c037d57557a4de · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-52992 · Nota de Segurança
• https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6 · Nota
• https://git.kernel.org/stable/c/60d82592ac8b5637fbed871381eb0a16df0a492e · Nota
• https://git.kernel.org/stable/c/1586bd2d2fb436a26df20a70e78b000d34a7d159 · Nota
• https://git.kernel.org/stable/c/a11372a8b1ceaa5e950a84b3b5fbf8228f25e277 · Nota