CVE-2026-97927

A flaw was found in the Linux kernel's Unix File System (UFS) implementation. This vulnerability allows a local user to cause a Denial of Service (DoS) by mounting a specially crafted or corrupted file system image. During a failed mount operation, an improper cleanup sequence leads to a null pointer dereference and a subsequent kernel crash.

A low impact denial of service flaw was found in the Linux kernel's Unix File System (UFS) implementation. When a specially crafted or corrupted UFS filesystem image is mounted, ufs_fill_super() installs the VFS root dentry (sb->s_root) before the cylinder group metadata is loaded. If reading the cylinder group structures fails on a writable mount, the error path frees the in-core superblock information and sets sb->s_fs_info to NULL while sb->s_root remains installed; the subsequent superblock teardown then calls sync_filesystem() and the put_super operation, both of which dereference the NULL UFS state, causing a kernel oops. Exploiting this flaw requires local access and the ability to mount a crafted filesystem image, which normally requires elevated (CAP_SYS_ADMIN) privileges, and it affects system availability only, with no impact on confidentiality or integrity. The Red Hat CVSS 3.1 score for this flaw is 5.5 (Moderate), while the current Red Hat impact rating is Low. Based on the current assessment, the vulnerable code is not present in the evaluated Red Hat Enterprise Linux (including the Real Time kernel), Red Hat In-Vehicle OS, and OpenShift Container Platform (RHEL CoreOS) streams, so those products are not affected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.