Executive brief
A vulnerability was identified in the Linux kernel's EXT4 file system component, which is responsible for managing data storage on many Linux-based systems. An attacker could potentially exploit this flaw to cause a system crash or gain unauthorized access to sensitive information by providing specially crafted mount options. This issue affects various systems using the Linux kernel, including certain industrial automation controllers from Siemens.
Technical details
A buffer over-read vulnerability exists in the 'parse_apply_sb_mount_options()' function within 'fs/ext4/super.c' of the Linux kernel. The root cause is the improper use of 'strscpy_pad()' when copying the 's_mount_opts' field, which may not be NUL-terminated when provided by userspace. This can trigger a fortified string function warning and a subsequent kernel panic or out-of-bounds read. An attacker with local privileges could exploit this by providing a non-NUL-terminated string in the mount options. The fix involves ensuring the destination buffer size matches the source and explicitly checking for NUL-termination, returning an error if the input is invalid. Patches have been released for various stable kernel branches.
Affected products
- Linux Linux Kernel 6.12.54-syzkaller-00144-g5f0270f1ba00
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.6
Timeline
- 2025-11-01: disclosed: Initial patch submission by Fedor Pchelkin
- 2026-01-14: advisory: NVD publication date
References
- https://git.kernel.org/stable/c/52ac96c4a2dd7bc47666000440b0602d9742e820
- https://git.kernel.org/stable/c/5bbacbbf1ca4419861dca3c6b82707c10e9c021c
- https://git.kernel.org/stable/c/6e37143560e37869d51b7d9e0ac61fc48895f8a0
- https://git.kernel.org/stable/c/902ca2356f1e3ec5355c5808ad5d3f9d0095b0cc
- https://git.kernel.org/stable/c/db9ee13fab0267eccf6544ee35b16c9522db9aac
- https://git.kernel.org/stable/c/ee5a977b4e771cc181f39d504426dbd31ed701cc
- https://cert-portal.siemens.com/productcert/html/ssa-019113.html