Skip to main content

Linux Kernel EUVDEUVD-2026-38998

| CVE-2026-53130 HIGH
Integer Underflow (CWE-191)
2026-06-24 Linux GHSA-2j9j-p8f4-hwp3
Information Disclosure Linux Integer Overflow Red Hat Suse
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Local crafted-image mount with user interaction (AV:L/UI:R); no attacker privilege needed to author the image (PR:N), and kernel memory corruption yields full C/I/A impact.

3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 09:12 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.8 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:30 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 24, 2026 - 16:30 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

AnalysisAI

Out-of-bounds kernel memory write in the Linux kernel's OMFS filesystem driver (fs/omfs) allows a local attacker to corrupt kernel memory by mounting a crafted OMFS image. omfs_fill_super() validates that s_sys_blocksize is not larger than PAGE_SIZE but fails to enforce a lower bound, so a value below OMFS_DIR_START (0x1b8 = 440) triggers an unsigned integer underflow in omfs_make_empty(), driving a roughly 4 GiB memset() that overwrites kernel memory far beyond the block buffer. There is no public exploit identified at time of analysis, the EPSS score is low (0.18%), and it is not listed in CISA KEV; the fix has been backported across many stable kernel branches.

Technical ContextAI

OMFS (Optimized MPEG File System) is a niche Linux filesystem driver originally created for ReplayTV/Rio Karma media devices, present in mainline since Linux 2.6.27. The bug is an integer underflow (CWE-191) leading to an out-of-bounds write (CWE-787): the superblock field s_sys_blocksize is a u32, and omfs_make_empty() computes 'sbi->s_sys_blocksize - OMFS_DIR_START' as the length passed to memset(). When s_sys_blocksize is smaller than the constant OMFS_DIR_START (440 bytes), the subtraction wraps around to a value near 2^32, so the memset writes ~4 GiB starting at bh->b_data + OMFS_DIR_START, trampling kernel memory adjacent to and beyond the backing buffer_head buffer. The CPE data identifies the affected product simply as cpe:2.3:a:linux:linux, i.e., the Linux kernel itself, with the defect confined to the fs/omfs code path exercised during superblock validation. The NVD/CVE record lists CWE as N/A, but the root cause is clearly an unsigned underflow.

RemediationAI

Vendor-released patch: upgrade to a fixed Linux kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1 (or your distribution's equivalent backport) - which adds the missing lower-bound check on s_sys_blocksize in omfs_fill_super(); the fix commits are at git.kernel.org (e.g. https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3). Where immediate patching is not possible, the most effective compensating control is to prevent untrusted OMFS images from ever being mounted: blacklist the omfs module (e.g. add 'install omfs /bin/true' in modprobe.d) so it cannot autoload, which has no side effects on systems that do not legitimately use OMFS. Additionally, restrict unprivileged and automatic mounting of removable media and disk images (review udisks/autofs policies and avoid user-mountable OMFS entries in fstab), accepting the trade-off that legitimate removable-media workflows for affected formats are disabled. Track remediation via the NVD advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-53130.

Same weakness CWE-191 – Integer Underflow

View all
CVE-2014-0497 CRITICAL POC
9.8
CVE-2015-5212 MEDIUM
6.8
CVE-2017-14496 HIGH POC
7.5
CVE-2014-8768 MEDIUM POC
5.0
CVE-2017-11757 CRITICAL POC
9.8
CVE-2024-23313 CRITICAL POC
9.8
CVE-2021-3323 CRITICAL POC
9.8
CVE-2021-21811 CRITICAL POC
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-38998 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy