CVE-2026-97489 in Linux
Summary
by MITRE • 09/24/2026
In the Linux kernel, the following vulnerability has been resolved:
bfs: handle set_blocksize failures
bfs uses buffer_heads, which don't handle block size > PAGE_SIZE well. Without this, mounting will hit the
BUG_ON(offset >= folio_size(folio));
in folio_set_bh on the first __bread_gfp call.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/24/2026
The BFS filesystem driver in the Linux kernel contained a critical flaw related to how it handled block size configurations during the mount process, specifically when attempting to set a block size larger than what is supported by its internal buffer head structures. This vulnerability stems from an insufficient validation of the requested block size before initializing file system operations that rely on fixed-size memory allocations and data structures. The BFS filesystem implementation utilizes buffer heads for managing disk blocks, which are fundamentally designed with constraints regarding maximum block sizes relative to the system page size. When a user or automated tool attempts to mount a BFS partition with a block size exceeding PAGE_SIZE, the kernel encounters an internal inconsistency because the underlying buffer head mechanisms cannot correctly map or manage memory pages of that magnitude within their expected operational parameters.
The technical root cause lies in the lack of error handling for the set_blocksize function call during the superblock initialization phase. In normal operation, if a block size is incompatible with the filesystem's structural requirements, the driver should gracefully reject the mount request and return an appropriate error code to the user space application. However, due to this oversight, the kernel proceeds with initializing file system structures assuming valid parameters. This leads directly to a trigger condition within the folio_set_bh function, where a BUG_ON macro checks if the offset is greater than or equal to the folio size. Since the block size exceeds PAGE_SIZE, and buffer heads are not designed to handle such large allocations in this context, the assertion fails immediately upon the first call to __bread_gfp, which attempts to read a disk block into memory.
This failure results in an immediate kernel panic rather than a graceful error return, effectively causing a denial of service against the host system. An attacker or local user with the ability to mount filesystems can exploit this by providing a crafted BFS image configured with an oversized block size parameter. Upon mounting, the kernel hits the BUG_ON condition and crashes, requiring a hard reset of the affected machine. This represents a significant stability issue for systems that allow unprivileged users to mount arbitrary filesystem images or when automated backup tools attempt to access corrupted or maliciously constructed disk images without proper validation layers in place before invoking kernel VFS operations.
From a classification perspective, this vulnerability aligns with CWE-252, which describes unchecked return values leading to unexpected behavior, and more specifically relates to improper input validation that results in system crashes. In the context of the MITRE ATT&CK framework for Linux systems, this can be categorized under techniques related to resource exhaustion or denial of service via kernel exploitation, although it is primarily a stability issue rather than an arbitrary code execution vector. The lack of bounds checking on filesystem parameters allows local users to disrupt system availability without requiring elevated privileges beyond those needed to invoke the mount syscall, depending on the specific configuration and security policies of the Linux distribution in use.
To mitigate this risk, kernel maintainers have implemented a fix that properly handles failures from set_blocksize by returning an error code instead of proceeding with initialization when invalid block sizes are detected. This ensures that the filesystem driver validates input parameters against its internal constraints before allocating resources or invoking low-level memory management functions like folio_set_bh. System administrators should ensure their kernels are updated to include this patch, particularly on systems where untrusted users have mount capabilities or where automated processes interact with external storage devices containing potentially malformed file system metadata. Regular auditing of filesystem mounting scripts and implementing strict validation rules for block sizes in custom backup solutions can further reduce the attack surface associated with such kernel-level input handling flaws.