CVE-2026-52992

fs/adfs: validate nzones in adfs_validate_bblk()

State: Published
Severity: Not scored
Published: Jun 24, 2026
Updated: Jun 24, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fs/adfs: validate nzones in adfs_validate_bblk()

Reject ADFS disc records with a zero zone count during boot block validation, before the disc record is used.

When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...) which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to dm[-1], causing an out-of-bounds write before the allocated buffer.

adfs_validate_dr0() already rejects nzones != 1 for old-format images. Add the equivalent check to adfs_validate_bblk() for new-format images so that a crafted image with nzones == 0 is rejected at probe time.

Found by syzkaller.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 33aafd2418a59c96c0389d47ea09026661fa9ec6Affected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 1f0ed0f57f0fc87e46fe19a05435c214dc464be2Affected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebcAffected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before a11372a8b1ceaa5e950a84b3b5fbf8228f25e277Affected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 1586bd2d2fb436a26df20a70e78b000d34a7d159Affected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before a3fd5dc1c7b0aae947a67dc2e2c037d57557a4deAffected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 60d82592ac8b5637fbed871381eb0a16df0a492eAffected f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before dd9d3e16c2d5fa166e13dce07413be51f42c8f5dAffected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 33aafd2418a59c96c0389d47ea09026661fa9ec6Affected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 1f0ed0f57f0fc87e46fe19a05435c214dc464be2Affected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebcAffected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before a11372a8b1ceaa5e950a84b3b5fbf8228f25e277Affected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 1586bd2d2fb436a26df20a70e78b000d34a7d159Affected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before a3fd5dc1c7b0aae947a67dc2e2c037d57557a4deAffected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before 60d82592ac8b5637fbed871381eb0a16df0a492eAffected
f6f14a0d71b0773a1d4147d1a3c33d537cd213ab to before dd9d3e16c2d5fa166e13dce07413be51f42c8f5dAffected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.