EUVD-2026-38860
GHSA-5h77-9826-97qg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local mounting of a crafted image needs some privilege or automount access (AV:L, PR:L, AC:L); a kernel heap OOB write yields high confidentiality, integrity, and availability impact.
Primary rating from NVD.
CVSS VectorNVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
In the Linux kernel, the following vulnerability has been resolved:
fs/adfs: validate nzones in adfs_validate_bblk()
Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used.
When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer.
adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time.
Found by syzkaller.
AnalysisAI
Out-of-bounds heap write in the Linux kernel's ADFS (Acorn Disc Filing System) driver allows a local attacker to corrupt kernel memory by mounting a crafted new-format ADFS disc image whose disc record declares a zone count of zero. adfs_read_map() forwards nzones==0 to kmalloc_array(0, ...), which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], an out-of-bounds write before the allocated buffer. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the ability to mount a crafted new-format ADFS filesystem image on the target, and the adfs kernel module must be present/loadable - a driver that is rarely compiled or enabled in modern distributions. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score is 7.8 (High) with vector AV:L/AC:L/PR:L/UI:N and full C:H/I:H/A:H impact, reflecting a local memory-corruption primitive. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local access to a system that has the adfs module available crafts a malformed new-format ADFS disc image whose disc record sets nzones=0, then induces a mount - either by invoking mount directly with sufficient privilege or by inserting a USB device on a host that auto-mounts removable media. When the kernel validates and reads the fragment map, it performs an out-of-bounds write before a zero-sized allocation, corrupting adjacent kernel heap memory and enabling denial of service or potential privilege escalation. … |
| Remediation | Vendor-released patch: upgrade to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 or later, matching your kernel series; the corresponding stable commits are published at https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6 (and sibling commits 1f0ed0f57f0f, 6ff8cca5cdb4, a11372a8b1ce, 1586bd2d2fb4, a3fd5dc1c7b0, 60d82592ac8b, dd9d3e16c2d5). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: identify and document all Linux systems with ADFS driver enabled and determine their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today