« Volver al listado

CVE-2026-97927

Estado: RecibidaSin puntuar—

In the Linux kernel, the following vulnerability has been resolved:

ufs: create the root dentry after loading cylinder metadata

ufs_fill_super() installed sb->s_root before it loaded the cylinder group structures for a writable mount:

When ufs_read_cylinder_structures() failed, the error path freed the in-core superblock information and set sb->s_fs_info to NULL while sb->s_root stayed installed. get_tree_bdev() then reached deactivate_locked_super(), and because s_root was present, generic_shutdown_super() called sync_filesystem() and the put_super operation. Both dereference UFS_SB(sb), which is now NULL, so a mount that fails only while reading the cylinder groups oopses during teardown. A crafted image whose first cylinder group cannot be read reaches this path.

Leer descripción completaMostrar menos

Load the cylinder group metadata first and create the root dentry last, so the superblock is published to the VFS only once it is fully set up. ufs_setup_cstotal() and ufs_read_cylinder_structures() take only the super_block and do not use the root inode, so the reordering is safe.

Detalles técnicos trazas, registros y código del informe original
	sb->s_root = d_make_root(inode);
	...
	if (!sb_rdonly(sb))
		if (!ufs_read_cylinder_structures(sb))
			goto failed;

CVSS

NVD no ha asignado puntuación CVSS a esta CVE (habitual desde el cambio de política de abril de 2026).

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux KernelAI

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-97927",
  "cveTags": [],
  "metrics": {},
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "e58db6c2dce6e453dca26c3a4953002425201880",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "05360c6eb8388bb5adac3c439ffb1512de39550a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "5cc48633fb76196b596a449ba1f4f642ad6125ce",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "cd21f1ff74b1c15077fa3b98e80da3b41055aae4",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "a9804121d55aaa4319c1cac00b99794aa177dd6a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "785e523b6c1931d802cab9f85912f3e6c7028af1",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "8173e051a8acbb4ae6547be0436727944119e0b5",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2",
              "lessThan": "55a4c98abb9694b067c6a031d11501f06b6b523c",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ufs/super.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.12"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "2.6.12",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.111",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.53",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.2.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc3",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ufs/super.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-25T11:17:19.950",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/05360c6eb8388bb5adac3c439ffb1512de39550a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/55a4c98abb9694b067c6a031d11501f06b6b523c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/5cc48633fb76196b596a449ba1f4f642ad6125ce",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/785e523b6c1931d802cab9f85912f3e6c7028af1",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8173e051a8acbb4ae6547be0436727944119e0b5",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/a9804121d55aaa4319c1cac00b99794aa177dd6a",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/cd21f1ff74b1c15077fa3b98e80da3b41055aae4",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e58db6c2dce6e453dca26c3a4953002425201880",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nufs: create the root dentry after loading cylinder metadata\n\nufs_fill_super() installed sb->s_root before it loaded the cylinder\ngroup structures for a writable mount:\n\n\tsb->s_root = d_make_root(inode);\n\t...\n\tif (!sb_rdonly(sb))\n\t\tif (!ufs_read_cylinder_structures(sb))\n\t\t\tgoto failed;\n\nWhen ufs_read_cylinder_structures() failed, the error path freed the\nin-core superblock information and set sb->s_fs_info to NULL while\nsb->s_root stayed installed. get_tree_bdev() then reached\ndeactivate_locked_super(), and because s_root was present,\ngeneric_shutdown_super() called sync_filesystem() and the put_super\noperation. Both dereference UFS_SB(sb), which is now NULL, so a mount\nthat fails only while reading the cylinder groups oopses during\nteardown. A crafted image whose first cylinder group cannot be read\nreaches this path.\n\nLoad the cylinder group metadata first and create the root dentry last,\nso the superblock is published to the VFS only once it is fully set up.\nufs_setup_cstotal() and ufs_read_cylinder_structures() take only the\nsuper_block and do not use the root inode, so the reordering is safe."
    }
  ],
  "lastModified": "2026-10-03T11:18:10.630",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}