Linux Kernel CVE-2026-97926

Exploitation requires the target to mount an attacker-crafted UFS/UFS2 filesystem image (e.g., malicious removable media or a supplied disk image) - the kernel must have UFS support compiled in and actually mount the image. The bug triggers during ordinary block/inode allocation or free operations after mount, when the unvalidated cached cg_cgx index and c_frotor/c_irotor rotor values are used as array indices and bitmap-scan starts. Limiting factors: the vector is local (AV:L), high-complexity (AC:H) since it depends on UFS media being mounted, and requires user/automount interaction (UI:R); mounting arbitrary filesystem images normally requires CAP_SYS_ADMIN unless removable-media automount is enabled, which further constrains the realistic attacker.

This is a genuine memory-corruption bug in the Linux kernel's UFS (BSD UFS/UFS2) filesystem driver, but the real-world risk is materially lower than the 7.0 CVSS suggests. The provided CVSS vector (AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H) is internally consistent for a malicious-filesystem-image threat model: exploitation is LOCAL, requires an attacker to craft a UFS image and a victim to mount it (UI:R), and is high-complexity (AC:H) because it depends on the target actually mounting UFS media. There is no EPSS score, no CISA KEV listing, and no public exploit code - no public exploit identified at time of analysis. The description establishes both an out-of-bounds WRITE (c_cgx indexing past the s_csp allocation) and an out-of-bounds READ/scan (rotor-driven unsigned-length wrap in ubh_scanc), so the C:H/I:H rating is plausible on paper, but no demonstrated privilege escalation or info leak is described - the dominant outcome is kernel corruption/crash. Note the CVSS gives PR:N/UI:R while mounting arbitrary filesystem images typically requires CAP_SYS_ADMIN in the mounting namespace unless automount/removable-media handling is enabled - verify the deployment's mount path before treating this as user-triggerable. UFS is a niche filesystem rarely mounted in production, so despite Linux's ubiquity this is a low-priority patch for most fleets, relevant mainly where untrusted removable media or user-mountable images are processed.

An attacker crafts a malformed UFS/UFS2 filesystem image whose cylinder-group headers carry an out-of-range cg_cgx index or rotor positions pointing outside the group. A victim (or an automount/removable-media handler) mounts the image and performs an allocation or free, at which point the unvalidated cached indices drive an out-of-bounds array write or a wrapped-length bitmap scan far past the cylinder-group buffers, corrupting kernel memory or crashing the system. No public exploit code is available at time of analysis.