Executive brief
A vulnerability was identified in the Linux kernel's Boot File System (BFS) driver where it failed to properly validate file type information when reading data from a disk. This could allow a corrupted or malicious disk image to cause the system to process incorrect file attributes, potentially leading to unexpected system behavior or crashes. The issue primarily affects legacy systems or specialized industrial hardware using this specific file system format.
Technical details
A vulnerability in the Linux kernel BFS (Boot File System) driver exists because the `bfs_iget` function in `fs/bfs/inode.c` does not properly mask or validate the `i_mode` and `i_vtype` fields when reading from disk. Specifically, the driver was trusting the upper bits of the 32-bit mode field, which are not explicitly defined in BFS documentation and can contain garbage or corrupted data. An attacker with the ability to mount a specially crafted BFS filesystem could trigger this by providing corrupted S_IFMT bits. The fix involves ignoring the S_IFMT bits from the disk's mode field and instead reconstructing the file type based on a validated `i_vtype` (ensuring it is either a regular file or a directory).
Affected products
- Linux Linux All versions prior to 6.13-rc1
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6 and later
Timeline
- 2025-10-23: other: Patch authored by Tetsuo Handa
- 2025-12-16: disclosed: CVE published
References
- https://git.kernel.org/stable/c/34ab4c75588c07cca12884f2bf6b0347c7a13872
- https://git.kernel.org/stable/c/77899444d46162aeb65f229590c26ba266864223
- https://git.kernel.org/stable/c/8f73336b75bd3457b6f9410f2a0601a238f32238
- https://git.kernel.org/stable/c/a8cb796e7e2cb7971311ba236922f5e7e1be77e6
- https://git.kernel.org/stable/c/a9f626396bfe66f49b743601e862767928237cc0
- https://git.kernel.org/stable/c/aeccd6743ee4fdd1ab8cfcbb5b9a20b613418f6d
- https://git.kernel.org/stable/c/d0c5ec1f57d8fbb953f166a27d9d32473dc8f3e4