Skip to main content

Linux Kernel EUVDEUVD-2026-38860

| CVE-2026-52992 HIGH
Out-of-bounds Write (CWE-787)
2026-06-24 Linux GHSA-5h77-9826-97qg
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local mounting of a crafted image needs some privilege or automount access (AV:L, PR:L, AC:L); a kernel heap OOB write yields high confidentiality, integrity, and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 14, 2026 - 20:42 vuln.today
CVSS changed
Jul 14, 2026 - 19:52 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
HIGH 7.8
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

fs/adfs: validate nzones in adfs_validate_bblk()

Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used.

When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer.

adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time.

Found by syzkaller.

AnalysisAI

Out-of-bounds heap write in the Linux kernel's ADFS (Acorn Disc Filing System) driver allows a local attacker to corrupt kernel memory by mounting a crafted new-format ADFS disc image whose disc record declares a zone count of zero. adfs_read_map() forwards nzones==0 to kmalloc_array(0, ...), which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], an out-of-bounds write before the allocated buffer. The flaw was found by syzkaller; there is no public exploit identified at time of analysis and EPSS scores it at just 0.18% (8th percentile).

Technical ContextAI

ADFS is the legacy Acorn/RISC OS disc filesystem, an optional and rarely-enabled kernel module (fs/adfs). During filesystem probe, adfs_validate_bblk() parses the on-disk 'disc record' from the boot block of a new-format image. The 'nzones' field describes how many fragment-map zones the volume contains and drives a kmalloc_array(nzones, ...) allocation in adfs_read_map(). When nzones is 0, the kernel's slab allocator returns the special ZERO_SIZE_PTR sentinel rather than a real buffer, and adfs_map_layout() indexes dm[-1], writing before the (non-existent) allocation. This is CWE-787 (Out-of-bounds Write) rooted in missing input validation of an attacker-controlled length taken from untrusted media. The old-format path already guarded against this via adfs_validate_dr0() rejecting nzones != 1; the fix adds the equivalent zero-zone rejection to the new-format validator so the record is rejected at probe time before use.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later, matching your kernel series; the corresponding stable commits are published at https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6 (and sibling commits 1f0ed0f57f0f, 6ff8cca5cdb4, a11372a8b1ce, 1586bd2d2fb4, a3fd5dc1c7b0, 60d82592ac8b, dd9d3e16c2d5). Because exploitation requires the ADFS driver to process a crafted image, an effective compensating control where patching is delayed is to prevent the module from loading - blacklist it via 'install adfs /bin/true' in modprobe.d (side effect: legitimate ADFS media becomes unmountable, which is negligible impact on virtually all modern systems since ADFS is essentially unused). Additionally, disable or restrict automatic mounting of removable/untrusted media (e.g. tighten udisks/udev automount policies) so an attacker cannot trigger the parser by inserting media; the trade-off is reduced convenience for legitimate removable-media workflows.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38860 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy