CVE-2026-43209

Bug

Description

The Linux kernel's fs/minix implementation lacked sufficient sanity checking in minix_check_superblock(). The minix filesystem code did not validate that s_log_zone_size is zero, which is the only value supported by the implementation and by util-linux mkfs.minix. Other superblock fields also lacked proper bounds checking, allowing an attacker to craft a malicious minix filesystem image that could trigger out-of-bounds access when the kernel tries to read zone or inode bitmaps. The issue was reported via a syzbot bug report and was resolved by adding validation and moving minix_blocks_needed() checks for the zone map (zmap) and inode map (imap) into minix_check_super_block() [1][2].

Exploitation

Exploitation requires an attacker to mount a specially crafted minix filesystem image. This could occur through physical access, a malicious USB drive, or a network-based filesystem share if the attacker can control the image. No authentication is needed beyond the ability to trigger a mount operation. The vulnerability is purely in the superblock parsing logic, so crafted data at mount time is sufficient to trigger the flaw. The attacker does not need to write to the filesystem; merely reading the forged superblock fields triggers the vulnerability [3][4].

Impact

A successful exploit can cause a denial-of-service (DoS) by crashing the kernel (e.g., through a NULL pointer dereference or memory corruption). The CVSS v3 score of 5.5 (Medium) reflects the requirement for local access or physical media insertion, but the impact is system availability. No privilege escalation or data exfiltration has been described; the primary consequence is a system panic or hang [1][4].

Mitigation

The fix is included in Linux kernel stable updates. Users should apply the latest kernel patches from their distribution to ensure that minix_check_superblock() performs the necessary validation. There is no workaround other than avoiding the use of untrusted minix filesystems or blocking the minix kernel module if it is not required. The vulnerability is not known to be exploited in the wild (not listed on CISA KEV as of publication) [2][3].