CVE-2026-97927

CVE CVE-2026-97927EUVD EUVD-2026-86781Published 2026-09-25T10:22:44.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ufs: create the root dentry after loading cylinder metadata ufs_fill_super() installed sb->s_root before it loaded the cylinder group structures for a writable mount: sb->s_root = d_make_root(inode); ... if (!sb_rdonly(sb)) if (!ufs_read_cylinder_structures(sb)) goto failed; When ufs_read_cylinder_structures() failed, the error path freed the in-core superblock information and set sb->s_fs_info to NULL while sb->s_root stayed installed. get_tree_bdev() then reached deactivate_locked_super(), and because s_root was present, generic_shutdown_super() called sync_filesystem() and the put_super operation. Both dereference UFS_SB(sb), which is now NULL, so a mount that fails only while reading the cylinder groups oopses during teardown. A crafted image whose first cylinder group cannot be read reaches this path. Load the cylinder group metadata first and create the root dentry last, so the superblock is published to the VFS only once it is fully set up. ufs_setup_cstotal() and ufs_read_cylinder_structures() take only the super_block and do not use the root inode, so the reordering is safe.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 0; patch: 6.12.111; patch: 7.2.7; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <8173e051a8acbb4ae6547be0436727944119e0b5; patch: 7.3-rc3; patch: 6.18.53; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <a9804121d55aaa4319c1cac00b99794aa177dd6a; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <785e523b6c1931d802cab9f85912f3e6c7028af1; 2.6.12; 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <55a4c98abb9694b067c6a031d11501f06b6b523c

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.