Description

In the Linux kernel, the following vulnerability has been resolved: ufs: validate cylinder group metadata before caching it ufs_read_cylinder() copies the cylinder group index and the rotor positions straight from the on-disk group and caches them without any check: ucpi->c_cgx = fs32_to_cpu(sb, ucg->cg_cgx); ucpi->c_rotor = fs32_to_cpu(sb, ucg->cg_rotor); ucpi->c_frotor = fs32_to_cpu(sb, ucg->cg_frotor); ucpi->c_irotor = fs32_to_cpu(sb, ucg->cg_irotor); They are then used as indices during allocation and free: - c_cgx indexes the cylinder summary array as UFS_SB(sb)->fs_cs(ucpi->c_cgx), so a value past s_ncg writes a 32 bit count outside the s_csp allocation. - c_frotor becomes a bitmap scan start, start = c_frotor >> 3, and then length = ((s_fpg + 7) >> 3) - start. A start beyond the block bitmap wraps the unsigned length to a huge value, so ubh_scanc() walks far past the cylinder group buffers. c_irotor drives the inode bitmap the same way. A crafted image can set any of these freely, turning an ordinary allocation into an out of bounds access. Reject a cylinder group whose recorded index does not match the group being read, or whose rotors fall outside the group, before the metadata is cached. Valid filesystems keep cg_cgx equal to the group number and the rotors within the group, so only malformed images are rejected.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.0",
  "pubDate": "2026-09-25T11:17:19.833Z",
  "pubdate": "2026-09-25T11:17:19.833Z",
  "executiveSummary": "The Linux kernel UFS filesystem implementation contains a critical memory safety vulnerability stemming from insufficient validation of on-disk cylinder group metadata.\nThe vulnerability is classified as an improper input validation issue leading to out-of-bounds memory access. An attacker capable of providing a crafted UFS filesystem image can trigger memory corruption within the kernel space.\nSuccessful exploitation allows for arbitrary out-of-bounds memory writes when the kernel performs block or inode allocation operations. This can lead to kernel-level data corruption, potentially resulting in system instability, kernel panics (Denial of Service), or theoretically, privilege escalation if the memory corruption facilitates control flow hijacking.\nThe issue affects the UFS driver within the Linux kernel. No authentication is required to trigger the vulnerability, as the kernel parses the metadata during the mounting or interaction with a malicious filesystem image.\nThis vulnerability poses a significant risk to systems that allow mounting untrusted UFS-formatted volumes, such as external storage media, as the malicious metadata is consumed by the kernel without verification.",
  "technicalDetails": "The vulnerability resides in the function ufs_read_cylinder(), which is responsible for caching metadata from a UFS cylinder group into kernel memory. The root cause is the lack of sanity checking on the cylinder group index (c_cgx) and rotor positions (c_rotor, c_frotor, c_irotor) before they are assigned to the ucpi structure.\nThe exploitation flow begins when the kernel reads a malicious UFS image. The fields cg_cgx, cg_rotor, cg_frotor, and cg_irotor are read from the disk and converted via fs32_to_cpu without validation. These fields are subsequently used as indices in critical filesystem operations.\nIn the case of c_cgx, the value is used as an index into the cylinder summary array (s_csp). If the value exceeds the total number of cylinder groups (s_ncg), the kernel attempts to write a 32-bit count to an address outside the bounds of the allocated s_csp buffer. This results in an arbitrary out-of-bounds write primitive.\nFurthermore, c_frotor and c_irotor serve as starting points for bitmap scanning. The kernel calculates the scan length using: length = ((s_fpg + 7) >> 3) - start. If an attacker crafts a large c_frotor value, the resulting start index causes the unsigned length calculation to wrap around to an extremely large value. Consequently, the helper function ubh_scanc() proceeds to scan far past the legitimate memory allocated for the cylinder group buffers.\nAn attacker can exploit this behavior by crafting a malicious filesystem where the cylinder group metadata points to critical kernel memory regions. During filesystem operations like file creation or block allocation, the kernel triggers these out-of-bounds operations, allowing the attacker to overwrite adjacent kernel memory structures. This vulnerability highlights the danger of trusting persistent on-disk metadata without enforcing strict boundary checks before memory caching.\nThe vulnerability is present in any version of the Linux kernel where UFS filesystem support is compiled and these specific validation steps are omitted in ufs_read_cylinder()."
}