Executive brief
A vulnerability exists in the Linux kernel's implementation of the Minix filesystem. An attacker with local access could potentially cause a system crash or denial of service by mounting a specially crafted Minix filesystem image that exploits missing validation checks in the filesystem's metadata. This affects systems that support mounting Minix drives or disk images.
Technical details
A vulnerability in fs/minix/inode.c exists due to insufficient validation in the minix_check_superblock() function. The implementation failed to properly verify the s_log_zone_size field (which must be 0) and did not adequately check the integrity of inode and zone maps (imap/zmap). An attacker can provide a malformed Minix filesystem superblock to trigger out-of-bounds conditions or other kernel instabilities. The fix introduces rigorous sanity checks for s_log_zone_size, s_ninodes, and bitmap block counts during the mount process.
Affected products
- Linux Linux Kernel versions from 2.6.12.1 up to 5.10.252; 5.11 up to 5.15.202; 5.16 up to 6.1.165; 6.2 up to 6.6.128; 6.7 up to 6.12.75; 6.13 up to 6.18.16; 6.19 up to 6.19.6
Timeline
- 2026-05-06: disclosed
- 2026-05-06: advisory
- 2026-03-04: patched
References
- https://git.kernel.org/stable/c/1efc128ee4adbc23e082715425ff895449d233bc
- https://git.kernel.org/stable/c/2bb588cede1c1969e49c0a2822c8cb8b346b7682
- https://git.kernel.org/stable/c/31fefc18096cdc5549cfa54964d90e0b3229aedc
- https://git.kernel.org/stable/c/66c7c239c65341f99ae388d4d53dc9df2bcb9925
- https://git.kernel.org/stable/c/8c97a6ddc95690a938ded44b4e3202f03f15078c
- https://git.kernel.org/stable/c/a051ecf5c5b0387840dc210413ed3bc7fbdaa69c
- https://git.kernel.org/stable/c/d791c544efd6b9c944b43cf7f502e5bcb02fb941