CVE-2026-97488

Received Received - Intake

QNX4 Filesystem Blocksize Handling Failure

Publication date: 2026-09-24

Last updated on: 2026-10-03

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: qnx4: handle set_blocksize failures qnx4 uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the BUG_ON(offset >= folio_size(folio)); in folio_set_bh on the first __bread_gfp call.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-10-03

Generated

2026-10-15

AI Q&A

2026-09-25

EPSS Evaluated

2026-10-13

NVD

CVE-2026-97488

EUVD

EUVD-2026-86086

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of set_blocksize failures in the qnx4 filesystem. The qnx4 filesystem uses buffer_heads which do not manage block sizes larger than PAGE_SIZE correctly. This can lead to a kernel bug when mounting filesystems, triggering a BUG_ON condition in folio_set_bh during the first __bread_gfp call.

Detection Guidance

This vulnerability is specific to the Linux kernel's qnx4 filesystem handling. Detection involves checking kernel logs for mount failures or BUG_ON errors related to qnx4 or folio_set_bh. Use commands like dmesg | grep -i qnx4 or journalctl -k | grep -i qnx4 to search for errors.

Impact Analysis

This vulnerability could cause system crashes or instability when mounting qnx4 filesystems with block sizes exceeding PAGE_SIZE. Users relying on qnx4 filesystems may experience kernel panics or unexpected system behavior, potentially leading to data loss or service disruption.

Compliance Impact

This vulnerability affects the Linux kernel's qnx4 filesystem handling, specifically related to block size failures. It does not directly impact compliance with standards like GDPR or HIPAA as it is a low-level filesystem issue rather than a data protection or privacy concern.

Mitigation Strategies

Update the Linux kernel to the latest patched version. Avoid mounting qnx4 filesystems if not required. If mounting is necessary, ensure block size does not exceed PAGE_SIZE to prevent triggering the BUG_ON condition.

Hi! I’m here to help you understand CVE-2026-97488. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70