CVE-2026-97926

A flaw was found in the Linux kernel's Unix File System (UFS) driver. When reading filesystem metadata from storage, the driver fails to validate cylinder group indices and rotor positions before caching them. A local attacker capable of mounting a specially crafted filesystem image could exploit this flaw to trigger out-of-bounds memory access, leading to a system crash and Denial of Service (DoS) or memory corruption.

A moderate impact out-of-bounds memory access flaw was found in the Linux kernel's Unix File System (UFS) driver. When reading a mounted UFS filesystem, ufs_read_cylinder() copies the cylinder group index (cg_cgx) and the rotor positions (cg_rotor, cg_frotor, cg_irotor) from the on-disk cylinder group metadata without validation and caches them. These cached values are later used as indices during block and inode allocation: an out-of-range cylinder group index causes a 32-bit write beyond the end of the s_csp cylinder summary allocation, and out-of-range rotor positions cause the unsigned bitmap scan length to wrap, driving ubh_scanc() far past the cylinder group buffers. A local attacker able to mount a specially crafted UFS filesystem image could exploit this flaw to trigger out-of-bounds kernel memory reads and writes, resulting in a system crash and denial of service or memory corruption. Exploitation requires local access and the ability to mount a filesystem image, which limits practical exposure and is reflected in the moderate impact rating despite the CVSS 3.1 base score of 7.0. The Red Hat Enterprise Linux 7, 8, 9, and 10, Red Hat In-Vehicle OS, and OpenShift 4 and 5 kernel builds recorded in this flaw are not affected because the vulnerable code is not present in those builds; the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.