CVE-2026-52992 Overview
CVE-2026-52992 is a Linux kernel vulnerability in the Acorn Disc Filing System (ADFS) filesystem driver. The flaw resides in adfs_validate_bblk(), which fails to validate the nzones field in ADFS disc records during boot block validation. A crafted filesystem image with nzones == 0 triggers an out-of-bounds write in adfs_map_layout(), because kmalloc_array(0, ...) returns ZERO_SIZE_PTR and the code subsequently writes to dm[-1]. The issue was discovered by syzkaller fuzzing and is fixed by rejecting disc records with a zero zone count before they are used.
Critical Impact
A crafted ADFS image mounted on a vulnerable kernel can cause an out-of-bounds write before the allocated buffer, leading to kernel memory corruption and potential denial of service or local privilege escalation.
Affected Products
- Linux kernel versions containing the fs/adfs driver prior to the referenced stable commits
- Distributions shipping kernels with ADFS support enabled (CONFIG_ADFS_FS)
- Systems that automatically probe removable media or untrusted disk images
Discovery Timeline
- 2026-06-24 - CVE-2026-52992 published to the National Vulnerability Database (NVD)
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-52992
Vulnerability Analysis
The vulnerability is an out-of-bounds write [CWE-787] in the Linux kernel ADFS filesystem code. During boot block validation, adfs_validate_bblk() parses a disc record supplied by the on-disk filesystem image. The validator already rejected nzones != 1 for old-format images via adfs_validate_dr0(), but no equivalent check existed for new-format images handled by adfs_validate_bblk(). As a result, an attacker-controlled image carrying nzones == 0 advanced past validation and reached the map allocation path.
Root Cause
The root cause is missing input validation on the nzones field of the ADFS disc record. When adfs_read_map() receives nzones = 0, it calls kmalloc_array(0, ...), which returns the sentinel value ZERO_SIZE_PTR rather than a valid allocation. The subsequent call into adfs_map_layout() then performs arithmetic that resolves to dm[-1], writing kernel data before the start of any real buffer.
Attack Vector
Exploitation requires the kernel to mount or probe a malicious ADFS image. This can occur when a local user mounts attacker-supplied media, when automounters process removable devices, or when loop-mounted images from untrusted sources are processed. The write occurs at probe time, before normal filesystem operations begin, making the path reachable as soon as the image is presented to the kernel.
No verified public exploit code is available. The vulnerability was identified by the syzkaller kernel fuzzer. Technical details are documented in the upstream fix commits, including Kernel Git Commit 1586bd2 and Kernel Git Commit a3fd5dc.
Detection Methods for CVE-2026-52992
Indicators of Compromise
- Kernel oops or panic messages referencing adfs_map_layout or adfs_read_map in dmesg or journalctl -k output
- KASAN reports flagging an out-of-bounds write near ZERO_SIZE_PTR during ADFS mount operations
- Mount attempts for ADFS images originating from untrusted users, removable media, or downloaded files
Detection Strategies
- Audit running kernels against the fixed commit list and flag hosts where CONFIG_ADFS_FS is enabled but the patch is absent
- Enable KASAN on test and pre-production kernels to catch the out-of-bounds write deterministically during fuzzing or QA
- Alert on mount syscalls invoking the adfs filesystem type, which is rarely used in modern environments and is a strong anomaly signal
Monitoring Recommendations
- Forward kernel logs to a central log platform and create rules for ADFS-related stack traces and KASAN splats
- Monitor automount and udev events that bind block devices to legacy filesystem drivers
- Track loopback mount activity from non-administrative users, particularly involving uncommon filesystem types
How to Mitigate CVE-2026-52992
Immediate Actions Required
- Apply the upstream stable kernel updates that include the adfs_validate_bblk()nzones validation fix
- Disable the ADFS filesystem module where it is not required by setting CONFIG_ADFS_FS=n or blacklisting the adfs module
- Restrict the ability of unprivileged users to mount filesystems and to attach loop devices on multi-user systems
Patch Information
The fix adds an explicit check rejecting ADFS disc records where nzones == 0 in adfs_validate_bblk(), mirroring the existing validation in adfs_validate_dr0() for old-format images. Stable backports are available across multiple kernel branches. Refer to the upstream commits: Kernel Git Commit 1586bd2, Kernel Git Commit 1f0ed0f, Kernel Git Commit 33aafd2, Kernel Git Commit 60d8259, Kernel Git Commit 6ff8cca, Kernel Git Commit a11372a, Kernel Git Commit a3fd5dc, and Kernel Git Commit dd9d3e1.
Workarounds
- Blacklist the ADFS kernel module to prevent it from being loaded when an ADFS image is encountered
- Block automatic mounting of removable media on servers and workstations that do not require it
- Limit CAP_SYS_ADMIN and constrain user namespace mount capabilities to reduce reachability of the vulnerable code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
