PT-2026-51886 · Linux · Linux
Published
2026-06-24
·
Updated
2026-06-24
·
CVE-2026-52992
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
fs/adfs: validate nzones in adfs validate bblk()
Reject ADFS disc records with a zero zone count during boot block
validation, before the disc record is used.
When nzones is 0, adfs read map() passes it to kmalloc array(0, ...)
which returns ZERO SIZE PTR, and adfs map layout() then writes to
dm[-1], causing an out-of-bounds write before the allocated buffer.
adfs validate dr0() already rejects nzones != 1 for old-format
images. Add the equivalent check to adfs validate bblk() for
new-format images so that a crafted image with nzones == 0 is
rejected at probe time.
Found by syzkaller.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux