CVE-2026-52992: Linux ADFS Out-of-Bounds Write via Zero Zone Count

Technical summary

The vulnerability exists in fs/adfs/adfs_validate_bblk(), which validates boot block information on ADFS filesystem images. When parsing a disc record with nzones == 0, the function fails to reject the invalid value. Subsequently, adfs_read_map() passes this zero value to kmalloc_array(0, ...), which returns ZERO_SIZE_PTR rather than failing. The adfs_map_layout() function then attempts to write to dm[-1], resulting in an out-of-bounds write that precedes the allocated buffer. The kernel already contains a similar check in adfs_validate_dr0() for old-format ADFS images that rejects nzones != 1. This fix adds an equivalent validation to adfs_validate_bblk() for new-format images, ensuring crafted images with nzones == 0 are rejected during filesystem probe rather than at read time.

Business impact

Systems running vulnerable kernels that mount ADFS filesystems—particularly those handling user-supplied or untrusted disc images—face localized privilege escalation risk. While ADFS is a legacy filesystem with limited modern use, environments supporting legacy systems, embedded devices, or forensic analysis workflows could be affected. An authenticated local attacker could exploit this to gain elevated privileges or trigger a denial-of-service condition, impacting system availability and confidentiality.

Affected systems

Linux kernel systems with ADFS filesystem support enabled are affected. The vulnerability requires local access and the ability to mount or trigger mounting of a specially crafted ADFS image. Legacy systems, embedded platforms, and environments providing file access to users are at higher risk.

Exploitability

Exploitation requires local access (privilege level L in the CVSS vector) and the ability to supply or mount a malformed ADFS disc image. No user interaction is required beyond the mount operation itself. The flaw is deterministic—a crafted image reliably triggers the out-of-bounds write. The attack surface is limited to systems that actively use ADFS, but the barrier to exploitation is low for authorized local users.

Remediation

Apply kernel updates containing the validation fix to adfs_validate_bblk(). The patch adds a check to reject ADFS disc records with nzones == 0 during boot block validation, preventing the malformed image from being processed. Verify the fix against your Linux distribution's kernel advisory for the specific version and patch details. As an interim mitigation, disable ADFS filesystem support in kernel configurations if the filesystem is not required, or restrict mount permissions to trusted administrators.

Patch guidance

Monitor your Linux distribution's security advisories for a kernel update addressing this ADFS validation issue. The fix is a small validation addition to reject zero zone counts early in the filesystem probe process. Apply the patch at your next scheduled kernel update cycle, prioritizing systems that handle ADFS images or allow untrusted mount operations. No kernel recompilation should be necessary if your distribution provides pre-built patched kernels.

Detection guidance

Monitor kernel logs for mount failures on ADFS filesystems, which may indicate attempts to mount crafted images. Look for audit logs recording failed filesystem mount operations with validation errors. If you enable CONFIG_ADFS in your kernel, consider implementing file integrity monitoring on ADFS disc images in your environment. Syzkaller and other fuzzing tools can be used to validate that your kernel correctly rejects malformed ADFS boot blocks.

Why prioritize this

This vulnerability merits prompt attention despite ADFS's legacy status because it enables local privilege escalation with a straightforward attack vector. The CVSS score of 7.8 reflects high impact across confidentiality, integrity, and availability. However, prioritization should be contextualized: organizations with minimal ADFS use may defer patching, while those supporting legacy systems or allowing user-supplied disc images should treat this as elevated priority.

Risk score, explained

The CVSS v3.1 score of 7.8 (HIGH) reflects a local vulnerability (AV:L) requiring low privilege (PR:L), no user interaction (UI:N), with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). The attack complexity is low (AC:L), meaning a straightforward malformed image reliably triggers the flaw. The lack of CVSS scope change (S:U) indicates the impact is confined to the vulnerable system.

Frequently asked questions