CVE-2026-43209

MediumCVSS 5.5/10Last modified Nov 11, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

minix: Add required sanity checking to minix_check_superblock()

The fs/minix implementation of the minix filesystem does not currently support any other value for s_log_zone_size than 0. This is also the only value supported in util-linux; see mkfs.minix.c line 511. In addition, this patch adds some sanity checking for the other minix superblock fields, and moves the minix_blocks_needed() checks for the zmap and imap also to minix_check_super_block().

This also closes a related syzbot bug report.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected software

VendorProductVersions
LinuxLinux>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a051ecf5c5b0387840dc210413ed3bc7fbdaa69c; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < d791c544efd6b9c944b43cf7f502e5bcb02fb941; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 66c7c239c65341f99ae388d4d53dc9df2bcb9925; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 2bb588cede1c1969e49c0a2822c8cb8b346b7682; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < f57ccd4657c7f082dc47e5b9e18a883bb5f9118f; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 31fefc18096cdc5549cfa54964d90e0b3229aedc; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 1efc128ee4adbc23e082715425ff895449d233bc; >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8c97a6ddc95690a938ded44b4e3202f03f15078c
LinuxLinux2.6.12

References

Timeline

Published
May 6, 2026
Last modified
Nov 11, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-43219.8Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Raera - Ankara Web Design and Digital CVE-2026-432105.5In the Linux kernel, the following vulnerability has been resolved: tracing: ring-buffer: Fix to check event length before using Check theCVE-2026-432117.8In the Linux kernel, the following vulnerability has been resolved: PCI: Fix pci_slot_trylock() error handling Commit a4e772898f8b ("PCI: CVE-2026-432127.8In the Linux kernel, the following vulnerability has been resolved: LoongArch: Make cpumask_of_node() robust against NUMA_NO_NODE The archCVE-2026-432137.5In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: pci: validate sequence number of TX release report HardwaCVE-2026-432147.8In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Add SRCU protection for reading PDPTRs in __get_sregs2() AddCVE-2026-432158.8In the Linux kernel, the following vulnerability has been resolved: cifs: Fix locking usage for tcon fields We used to use the cifs_tcp_seCVE-2026-432165.5In the Linux kernel, the following vulnerability has been resolved: net: Drop the lock in skb_may_tx_timestamp() skb_may_tx_timestamp() maCVE-2026-432175.5In the Linux kernel, the following vulnerability has been resolved: media: iris: gen2: Add sanity check for session stop In iris_kill_sessCVE-2026-432185.5In the Linux kernel, the following vulnerability has been resolved: media: i2c/tw9903: Fix potential memory leak in tw9903_probe() In one CVE-2026-432195.5In the Linux kernel, the following vulnerability has been resolved: net: cpsw_new: Fix potential unregister of netdev that has not been regCVE-2026-43226.1Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Raera - Ankara Web Design and Digital
CVE-2026-43209: Medium severity, CVSS 5.5 | Vulnix