EUVD-2026-76468
GHSA-233m-c5r9-wq53
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
AC:H because exploitation requires presenting a specifically crafted MD superblock that the kernel will load; otherwise metrics align with local kernel memory corruption.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
md: do overflow check for sb->bblog_shift in super_1_load()
In super_1_load(), sb->bblog_shift is an __u8 type value loaded from on- disk superblock. It is used for badblocks API badblocks_set() by the following sequence,
1930 rdev->badblocks.shift = sb->bblog_shift; 1931 for (i = 0 ; i < (sectors << (9-3)) ; i++, bbp++) { 1932 u64 bb = le64_to_cpu(*bbp); 1933 int count = bb & (0x3ff); 1934 u64 sector = bb >> 10; 1935 sector <<= sb->bblog_shift; 1936 count <<= sb->bblog_shift; 1937 if (bb + 1 == 0) 1938 break; 1939 if (!badblocks_set(&rdev->badblocks, sector, count, 1)) 1940 return -EINVAL; 1941 }
bb->bblog_shit is in range of 0-255, variable sector is 64bit width, for an invalid bb->bblog_shit, it is possible to make sector be overflowed by the following calculation, 1935 sector <<= sb->bblog_shift; Then in turn when call badblocks_set() at line 1939 with the invalid rdev->badblocks.shift set at line 1930, may result an overflow inside _badblocks_clear() in block/badblocks.c.
Although there are many places to call badblocks APIs, the non-zero shift value is only used in super_1_load(), other places always use 0 as the shift value. Therefore it is unnecessary to do a general shift value overflow check inside badblock API, and just check here as the caller.
This may avoid unnecessary check, make the badblocks API code more simple and elegant.
AnalysisAI
Integer overflow in the Linux kernel's MD (software RAID) subsystem allows a local attacker who can supply or mount a crafted block device superblock to trigger an unchecked bit-shift overflow in super_1_load(), corrupting kernel memory and potentially escalating privileges. The flaw stems from sb->bblog_shift - an 8-bit on-disk value ranging 0-255 - being applied as a left-shift to a 64-bit sector variable without any upper-bound validation, allowing sector and count variables to wrap around and corrupt downstream badblocks API state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires: (1) local access to the target system; (2) the ability to cause the Linux kernel to load an MD version-1 superblock from a block device - typically by running mdadm --assemble or triggering automatic MD array detection (mdadm --auto-detect or udev rules); (3) control over the content of the on-disk superblock, meaning the attacker can present a crafted block device image (physical removable media, loopback device, or pass-through virtual disk). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H scores 7.8, which is largely credible for a local kernel memory corruption bug but may overstate AC as Low - exploitation requires the attacker to supply a specially crafted MD superblock that the kernel will actually load, which implies either control of a physical/virtual block device or the ability to hot-add a device, a non-trivial prerequisite that argues for AC:H. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | The primary fix is upgrading to a patched kernel version: 6.12.109, 6.18.50, 7.2.4, or applying the 7.3-rc1 patch, all available via kernel.org stable trees at the git.kernel.org links in the references. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: Identify all production Linux systems running the MD/software RAID subsystem and verify current kernel versions against available patches for your Linux distribution. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today