CVE-2026-97486 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
hpfs: handle set_blocksize failures
hpfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The hpfs filesystem driver in the Linux kernel contains a critical flaw related to how it handles block size configurations during mount operations, specifically when the requested block size exceeds the system page size. This vulnerability stems from an improper assumption regarding the compatibility of buffer heads with larger block sizes. Buffer heads are internal data structures used by the VFS layer to manage disk blocks and their mapping in memory. The hpfs implementation fails to adequately validate or handle scenarios where set_blocksize is invoked with a value greater than PAGE_SIZE, which is typically 4096 bytes on most architectures but can vary depending on system configuration.
When an attempt is made to mount an HPFS filesystem with such a block size, the kernel encounters a fatal assertion failure within the folio_set_bh function. Specifically, the code triggers a BUG_ON condition that checks if the offset exceeds the folio size. Since buffer heads are not designed to manage blocks larger than the page size in this context, the mismatch between the requested block size and the internal memory management structures leads directly to kernel panic or crash during the initial read operations performed by __bread_gfp. This represents a denial of service vulnerability that can be triggered locally by any user with permission to mount filesystems using specific parameters, effectively rendering the system unstable if exploited in an interactive environment.
From a technical classification perspective, this issue aligns with CWE-20 Improper Input Validation and CWE-754 Incorrect Check for Unusual or Exceptional Conditions. The root cause lies in the lack of robust error handling when dealing with edge cases involving block size parameters that exceed standard memory page boundaries. In terms of attack vectors, this falls under ATT&CK technique T1496 Resource Hijacking if considered as a denial-of-service impact, although it is more accurately described as an instability trigger due to unhandled exceptional conditions in kernel space rather than malicious resource consumption per se.
The operational impact of this vulnerability includes system crashes or panics during the mounting process, which can disrupt services and require manual intervention to recover. It also prevents legitimate administrative tasks from being completed if administrators attempt to use non-standard block sizes for performance tuning or compatibility reasons with legacy HPFS volumes that may specify larger blocks. Mitigation strategies involve applying kernel patches that update the hpfs driver to properly validate block size inputs before proceeding with buffer head allocation and folio operations. Administrators should ensure their systems are updated with the latest stable kernel versions where this fix has been integrated, thereby preventing the assertion failure from being triggered during filesystem initialization.