CVE-2026-72369

A flaw was found in the Linux kernel's Minix filesystem. A local attacker can exploit this vulnerability by mounting a specially crafted Minix v3 image. This image can contain specific inode or zone counts that trigger an integer overflow during the calculation of bitmap block counts. The overflow leads to the kernel attempting to dereference unallocated memory, causing a kernel panic and resulting in a denial of service (DoS).

This vulnerability is rated as having Moderate impact because exploitation requires local access and the capability to mount filesystems, limiting the blast radius to a denial of service via kernel panic. The Minix filesystem is a legacy format that is not actively utilized in standard enterprise deployments, and the module is not loaded by default on Red Hat Enterprise Linux. Consequently, standard system operations are not exposed unless an administrator or privileged container explicitly mounts an untrusted Minix storage image.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.