{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72369", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-09T03:40:39.922Z", "datePublished": "2026-08-15T05:56:05.995Z", "dateUpdated": "2026-08-17T05:43:23.188Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:43:23.188Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nminix: avoid overflow in bitmap block count calculation\n\nminix_check_superblock() uses minix_blocks_needed() to verify that the\non-disk imap and zmap block counts are large enough for the advertised\ninode and zone counts.\n\nThe helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.\nA Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the\naddition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap\nblock count look valid, after which minix_fill_super() can dereference\ns_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.\n\nImpact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is\nnear UINT_MAX makes minix_check_superblock() accept a zero bitmap-block\ncount and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking\nthe kernel.\n\nThe divisor is the bitmap capacity in bits, blocksize * 8, which is\nalways a power of two: minix_fill_super() obtains the block size through\nsb_set_blocksize(), and blk_validate_block_size() rejects any size that\nis not a power of two. Use DIV_ROUND_UP_POW2(), which divides before\nadding the round-up term and so cannot overflow for a power-of-two\ndivisor."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The bug is reached only when the kernel parses a crafted Minix V3 on-disk superblock during block-device mount (mount(2)/fsopen+fsmount \u2192 get_tree_bdev \u2192 minix_fill_super); Minix is not exposed via ksmbd, nfsd, or any network protocol handler.\nAC:L - A Minix V3 image with s_ninodes or s_zones near UINT_MAX and zero/small imap/zmap block counts deterministically makes minix_blocks_needed() wrap to zero, bypassing minix_check_superblock() every time without races or attacker-uncontrollable heap layout.\nPR:L - may_mount() requires CAP_SYS_ADMIN in the mount namespace, which unprivileged attackers obtain inside user namespaces; syzbot reproduced this via fuzzed mounts, and a loop-backed image supplies the required block device without init-namespace root.\nUI:N - No victim action is needed when the attacker with mount capability (e.g., CAP_SYS_ADMIN in a user/mount namespace) mounts their own malicious Minix v3 loop image; exploitation does not depend on tricking another user to open a file or insert removable media.\nS:U - The flaw corrupts or crashes kernel memory during superblock initialization in the mounting context only; it does not cross VM, container, or IOMMU boundaries and matches standard in-kernel memory-corruption/DoS impact (Scope Unchanged).\nC:H - With imap_blocks=1 and overflow-bypassed zmap_blocks=0, s_zmap=&map[1] performs an out-of-bounds heap read of a buffer_head pointer past the under-allocated map; s_imap[0]/s_zmap[0] dereferences on zero-block images also read uninitialized/garbage pointers before panic.\nI:H - After the overflow bypass, minix_set_bit(0,sbi->s_zmap[0]->b_data) uses the OOB-read pointer and can set a bit at an attacker-influenced kernel address; this is exploitable memory corruption during mount, not a guaranteed-safe NULL-only crash.\nA:H - minix_fill_super() dereferences unallocated s_imap[0]/s_zmap[0] entries and faults the kernel (oops/panic); even the one-bit write via corrupted pointers can immediately fault, causing total loss of kernel availability on the affected system."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/minix/minix.h"], "versions": [{"version": "2bb588cede1c1969e49c0a2822c8cb8b346b7682", "lessThan": "a11ebaab50d27d6c4c78506f84ff36452e0b901d", "status": "affected", "versionType": "git"}, {"version": "f57ccd4657c7f082dc47e5b9e18a883bb5f9118f", "lessThan": "959c95340a9e19cd333b4c18935fdeecbb2f319d", "status": "affected", "versionType": "git"}, {"version": "31fefc18096cdc5549cfa54964d90e0b3229aedc", "lessThan": "abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5", "status": "affected", "versionType": "git"}, {"version": "8c97a6ddc95690a938ded44b4e3202f03f15078c", "lessThan": "8a29e60e2176b02e04f8737c8b32b696230eb0c5", "status": "affected", "versionType": "git"}, {"version": "8c97a6ddc95690a938ded44b4e3202f03f15078c", "lessThan": "fb3e566cafc38fe3ba35e6843a2d529a3748870c", "status": "affected", "versionType": "git"}, {"version": "a051ecf5c5b0387840dc210413ed3bc7fbdaa69c", "status": "affected", "versionType": "git"}, {"version": "d791c544efd6b9c944b43cf7f502e5bcb02fb941", "status": "affected", "versionType": "git"}, {"version": "66c7c239c65341f99ae388d4d53dc9df2bcb9925", "status": "affected", "versionType": "git"}, {"version": "1efc128ee4adbc23e082715425ff895449d233bc", "status": "affected", "versionType": "git"}, {"version": "6.6.128", "lessThan": "6.6.145", "status": "affected", "versionType": "semver"}, {"version": "6.12.75", "lessThan": "6.12.97", "status": "affected", "versionType": "semver"}, {"version": "6.18.16", "lessThan": "6.18.40", "status": "affected", "versionType": "semver"}, {"version": "5.10.252", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.15.202", "lessThan": "5.16", "status": "affected", "versionType": "semver"}, {"version": "6.1.165", "lessThan": "6.2", "status": "affected", "versionType": "semver"}, {"version": "6.19.6", "lessThan": "6.20", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/minix/minix.h"], "versions": [{"version": "7.0", "status": "affected"}, {"version": "0", "lessThan": "7.0", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.128", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.16", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "7.0", "versionEndExcluding": "7.2"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.252"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.202"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1.165"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/a11ebaab50d27d6c4c78506f84ff36452e0b901d"}, {"url": "https://git.kernel.org/stable/c/959c95340a9e19cd333b4c18935fdeecbb2f319d"}, {"url": "https://git.kernel.org/stable/c/abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5"}, {"url": "https://git.kernel.org/stable/c/8a29e60e2176b02e04f8737c8b32b696230eb0c5"}, {"url": "https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}], "title": "minix: avoid overflow in bitmap block count calculation", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/minix/minix.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "a11ebaab50d27d6c4c78506f84ff36452e0b901d", "status": "affected", "version": "2bb588cede1c1969e49c0a2822c8cb8b346b7682", "versionType": "git"}, {"lessThan": "959c95340a9e19cd333b4c18935fdeecbb2f319d", "status": "affected", "version": "f57ccd4657c7f082dc47e5b9e18a883bb5f9118f", "versionType": "git"}, {"lessThan": "abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5", "status": "affected", "version": "31fefc18096cdc5549cfa54964d90e0b3229aedc", "versionType": "git"}, {"lessThan": "8a29e60e2176b02e04f8737c8b32b696230eb0c5", "status": "affected", "version": "8c97a6ddc95690a938ded44b4e3202f03f15078c", "versionType": "git"}, {"lessThan": "fb3e566cafc38fe3ba35e6843a2d529a3748870c", "status": "affected", "version": "8c97a6ddc95690a938ded44b4e3202f03f15078c", "versionType": "git"}, {"status": "affected", "version": "a051ecf5c5b0387840dc210413ed3bc7fbdaa69c", "versionType": "git"}, {"status": "affected", "version": "d791c544efd6b9c944b43cf7f502e5bcb02fb941", "versionType": "git"}, {"status": "affected", "version": "66c7c239c65341f99ae388d4d53dc9df2bcb9925", "versionType": "git"}, {"status": "affected", "version": "1efc128ee4adbc23e082715425ff895449d233bc", "versionType": "git"}, {"lessThan": "6.6.145", "status": "affected", "version": "6.6.128", "versionType": "semver"}, {"lessThan": "6.12.97", "status": "affected", "version": "6.12.75", "versionType": "semver"}, {"lessThan": "6.18.40", "status": "affected", "version": "6.18.16", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.252", "versionType": "semver"}, {"lessThan": "5.16", "status": "affected", "version": "5.15.202", "versionType": "semver"}, {"lessThan": "6.2", "status": "affected", "version": "6.1.165", "versionType": "semver"}, {"lessThan": "6.20", "status": "affected", "version": "6.19.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/minix/minix.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "7.0"}, {"lessThan": "7.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nminix: avoid overflow in bitmap block count calculation\n\nminix_check_superblock() uses minix_blocks_needed() to verify that the\non-disk imap and zmap block counts are large enough for the advertised\ninode and zone counts.\n\nThe helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.\nA Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the\naddition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap\nblock count look valid, after which minix_fill_super() can dereference\ns_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.\n\nImpact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is\nnear UINT_MAX makes minix_check_superblock() accept a zero bitmap-block\ncount and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking\nthe kernel.\n\nThe divisor is the bitmap capacity in bits, blocksize * 8, which is\nalways a power of two: minix_fill_super() obtains the block size through\nsb_set_blocksize(), and blk_validate_block_size() rejects any size that\nis not a power of two. Use DIV_ROUND_UP_POW2(), which divides before\nadding the round-up term and so cannot overflow for a power-of-two\ndivisor."}], "id": "CVE-2026-72369", "lastModified": "2026-08-17T06:18:41.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-08-15T06:22:10.340", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8a29e60e2176b02e04f8737c8b32b696230eb0c5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/959c95340a9e19cd333b4c18935fdeecbb2f319d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a11ebaab50d27d6c4c78506f84ff36452e0b901d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: minix: avoid overflow in bitmap block count calculation", "id": "2516624", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516624"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-824", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nminix: avoid overflow in bitmap block count calculation\nminix_check_superblock() uses minix_blocks_needed() to verify that the\non-disk imap and zmap block counts are large enough for the advertised\ninode and zone counts.\nThe helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.\nA Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the\naddition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap\nblock count look valid, after which minix_fill_super() can dereference\ns_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.\nImpact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is\nnear UINT_MAX makes minix_check_superblock() accept a zero bitmap-block\ncount and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking\nthe kernel.\nThe divisor is the bitmap capacity in bits, blocksize * 8, which is\nalways a power of two: minix_fill_super() obtains the block size through\nsb_set_blocksize(), and blk_validate_block_size() rejects any size that\nis not a power of two. Use DIV_ROUND_UP_POW2(), which divides before\nadding the round-up term and so cannot overflow for a power-of-two\ndivisor.", "A flaw was found in the Linux kernel's Minix filesystem. A local attacker can exploit this vulnerability by mounting a specially crafted Minix v3 image. This image can contain specific inode or zone counts that trigger an integer overflow during the calculation of bitmap block counts. The overflow leads to the kernel attempting to dereference unallocated memory, causing a kernel panic and resulting in a denial of service (DoS)."], "name": "CVE-2026-72369", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-72369\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-72369\nhttps://lore.kernel.org/linux-cve-announce/2026081515-CVE-2026-72369-1ec9@gregkh/T"], "threat_severity": "Moderate"}