PT-2026-37070 · Linux · Linux Kernel

Published 2026-05-05 · Updated 2026-05-13 · CVE-2026-43067

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ext4 file system regarding the handling of wraparound when searching for blocks for indirect mapped blocks. In environments where a file system contains both extent-mapped and indirect-block mapped files or directories, it is possible for the start value to be greater than or equal to ngroups. This occurs because the first iteration of the loop in ext4 mb scan groups linear() calls ext4 mb scan group() with an unsupported group before next linear group() is invoked, potentially allowing the allocation of blocks beyond the 32-bit limit for indirect block mapped files. This is addressed by implementing a safety clamp in the ext4 mb scan groups() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-43067

Affected Products

Linux Kernel

References · 17

• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43067 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-43067 · Vendor Advisory
• https://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-43067 · Security Note
• https://ubuntu.com/security/CVE-2026-43067 · Vendor Advisory
• https://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930 · Patch
• https://security-tracker.debian.org/tracker/CVE-2026-43067 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-43067 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-43067 · Security Note
• https://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503 · Patch
• https://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c · Patch
• https://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f · Patch
• https://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1 · Patch
• https://twitter.com/lyrie_ai/status/2054555680384733659 · Twitter Post
• https://git.kernel.org/linus/bb81702370fad22c06ca12b6e1648754dbc37e0f · Note