Executive brief
The Linux kernel's RAID metadata (md) superblock parser fails to validate a shift value loaded from disk, allowing an integer overflow when processing bad-block information. An attacker with access to craft malicious disk metadata could trigger memory corruption in the kernel's bad-blocks tracking code, potentially causing a denial of service or kernel crash.
Technical details
The vulnerability exists in the super_1_load() function in the Linux kernel's md (RAID) subsystem. The function loads an 8-bit bblog_shift value from the on-disk superblock without validating its range before using it in a left-shift operation on a 64-bit sector variable. When an attacker supplies an invalid bblog_shift value (0-255), the calculation "sector <<= sb->bblog_shift" can overflow, leading to incorrect values passed to badblocks_set(). This overflow propagates into block/badblocks.c where further memory corruption may occur. The attack requires the ability to modify or craft malicious RAID superblock data on disk, which could be achieved through direct device access or by compromising a storage backend. The fix involves adding overflow validation for bblog_shift in super_1_load() before it is used.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed