CVE-2026-97927
Received Received - Intake

UFS Filesystem Mount Oops on Cylinder Group Read Failure

Publication date: 2026-09-25

Last updated on: 2026-09-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufs_fill_super() installed sb->s_root before it loaded the cylinder group structures for a writable mount: sb->s_root = d_make_root(inode); ... if (!sb_rdonly(sb)) if (!ufs_read_cylinder_structures(sb)) goto failed; When ufs_read_cylinder_structures() failed, the error path freed the in-core superblock information and set sb->s_fs_info to NULL while sb->s_root stayed installed. get_tree_bdev() then reached deactivate_locked_super(), and because s_root was present, generic_shutdown_super() called sync_filesystem() and the put_super operation. Both dereference UFS_SB(sb), which is now NULL, so a mount that fails only while reading the cylinder groups oopses during teardown. A crafted image whose first cylinder group cannot be read reaches this path. Load the cylinder group metadata first and create the root dentry last, so the superblock is published to the VFS only once it is fully set up. ufs_setup_cstotal() and ufs_read_cylinder_structures() take only the super_block and do not use the root inode, so the reordering is safe.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-25
Last Modified
2026-09-25
Generated
2026-09-25
AI Q&A
2026-09-25
EPSS Evaluated
N/A
NVD
CVE-2026-97927
EUVD
EUVD-2026-86781

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper initialization of the root dentry in the UFS filesystem. The function ufs_fill_super() sets up the root dentry before loading cylinder group metadata. If loading the metadata fails, the superblock is partially torn down while the root dentry remains, causing a crash during cleanup when dereferencing a null pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's UFS filesystem implementation. Detection requires checking the kernel version and UFS filesystem usage. Commands like uname -a to check kernel version and mount | grep ufs to verify UFS mounts can help identify exposure. If your system uses UFS and runs a vulnerable kernel version, it may be affected.

Impact Analysis

An attacker could exploit this by crafting a filesystem image that fails during cylinder group loading. This would crash the system during mount cleanup, potentially leading to denial of service or unauthorized access if combined with other exploits.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version provided by your distribution. Avoid using the UFS filesystem if possible, or restrict its use to read-only mounts until patched. Monitor kernel security advisories for updates addressing this issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-97927. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart