CVE-2026-43067

{"id": "CVE-2026-43067", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43067", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:16.994971Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.8, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 3.9}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9d89b9d55e25cb340c5b4b769876edc551b7a9ff", "lessThan": "f89bba144938921a2249237ad04a0183ff3f8930", "versionType": "git"}, {"status": "affected", "version": "1b0edd6022a3f44ce87fea9959a9310f4628fbea", "lessThan": "83170a05908b6cf2fb3235d3065bf613ff866f3c", "versionType": "git"}, {"status": "affected", "version": "9eea2f57d11b30049ff996ac3eff6e0dc8089e5f", "lessThan": "4bec4a498ce86314d470ae6144120461f2138c29", "versionType": "git"}, {"status": "affected", "version": "34c803edc0b3365a42efcf9815acab63b4cf54e0", "lessThan": "12624c5b724a81e14e532972b40d863b0de3b7d1", "versionType": "git"}, {"status": "affected", "version": "321ed8d559c951e71ad2d2d69a4cf0445644e865", "lessThan": "2a368ccddfc492a0aa951e2caef2985f20e96503", "versionType": "git"}, {"status": "affected", "version": "4865c768b563deff1b6a6384e74a62f143427b42", "lessThan": "bb81702370fad22c06ca12b6e1648754dbc37e0f", "versionType": "git"}, {"status": "affected", "version": "16fce6b6c0b247258c6c217fce5a48abf50f6964", "versionType": "git"}, {"status": "affected", "version": "5.15.203", "lessThan": "5.16", "versionType": "semver"}], "programFiles": ["fs/ext4/mballoc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.1.167", "lessThan": "6.1.168", "versionType": "semver"}, {"status": "affected", "version": "6.6.130", "lessThan": "6.6.134", "versionType": "semver"}, {"status": "affected", "version": "6.12.77", "lessThan": "6.12.80", "versionType": "semver"}, {"status": "affected", "version": "6.18.14", "lessThan": "6.18.21", "versionType": "semver"}, {"status": "affected", "version": "6.19.4", "lessThan": "6.19.11", "versionType": "semver"}], "programFiles": ["fs/ext4/mballoc.c"], "defaultStatus": "unaffected"}]}], "published": "2026-05-05T16:16:15.937", "references": [{"url": "https://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "description": [{"lang": "en", "value": "CWE-822"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: handle wraparound when searching for blocks for indirect mapped blocks\n\nCommit 4865c768b563 (\"ext4: always allocate blocks only from groups\ninode can use\") restricts what blocks will be allocated for indirect\nblock based files to block numbers that fit within 32-bit block\nnumbers.\n\nHowever, when using a review bot running on the latest Gemini LLM to\ncheck this commit when backporting into an LTS based kernel, it raised\nthis concern:\n\n If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal\n group was populated via stream allocation from s_mb_last_groups),\n then start will be >= ngroups.\n\n Does this allow allocating blocks beyond the 32-bit limit for\n indirect block mapped files? The commit message mentions that\n ext4_mb_scan_groups_linear() takes care to not select unsupported\n groups. However, its loop uses group = *start, and the very first\n iteration will call ext4_mb_scan_group() with this unsupported\n group because next_linear_group() is only called at the end of the\n iteration.\n\nAfter reviewing the code paths involved and considering the LLM\nreview, I determined that this can happen when there is a file system\nwhere some files/directories are extent-mapped and others are\nindirect-block mapped. To address this, add a safety clamp in\next4_mb_scan_groups()."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ext4: manejar el desbordamiento al buscar bloques para bloques mapeados indirectamente El commit 4865c768b563 (\u2019ext4: siempre asignar bloques solo de grupos que el inodo puede usar\u2019) restringe qu\u00e9 bloques se asignar\u00e1n para archivos basados en bloques indirectos a n\u00fameros de bloque que encajen dentro de n\u00fameros de bloque de 32 bits. Sin embargo, al usar un bot de revisi\u00f3n ejecut\u00e1ndose en el \u00faltimo LLM Gemini para verificar este commit al hacer un backport a un kernel basado en LTS, plante\u00f3 esta preocupaci\u00f3n: \u2019Si ac -> ac_g_ex.fe_group es mayor o igual que ngroups (por ejemplo, si el grupo objetivo fue poblado mediante asignaci\u00f3n de flujo desde s_mb_last_groups), entonces start ser\u00e1 mayor o igual que ngroups. \u00bfPermite esto asignar bloques m\u00e1s all\u00e1 del l\u00edmite de 32 bits para archivos mapeados por bloques indirectos? El mensaje del commit menciona que ext4_mb_scan_groups_linear() se encarga de no seleccionar grupos no soportados. Sin embargo, su bucle usa group = start, y la primera iteraci\u00f3n llamar\u00e1 a ext4_mb_scan_group() con este grupo no soportado porque next_linear_group() solo se llama al final de la iteraci\u00f3n.\u2019 Despu\u00e9s de revisar las rutas de c\u00f3digo involucradas y considerar la revisi\u00f3n del LLM, determin\u00e9 que esto puede ocurrir cuando hay un sistema de archivos donde algunos archivos/directorios est\u00e1n mapeados por extensiones y otros est\u00e1n mapeados por bloques indirectos. Para abordar esto, a\u00f1adir un l\u00edmite de seguridad en ext4_mb_scan_groups()."}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "65BC3363-9FA5-4980-B120-042521BD0F34", "versionEndExcluding": "5.16", "versionStartIncluding": "5.15.203"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B71F66A1-26CE-4A17-BBAB-34A1AE897567", "versionEndExcluding": "6.6.134", "versionStartIncluding": "6.6.130"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C8D55175-C5FF-47BC-BC65-A2B06E3021A1", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.77"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "DEA57E4E-36B0-40D5-98B9-6A50348C9E74", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A67B0458-DAE3-4940-BBB2-1A4D263AF27B", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.4"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.1.167:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B898A4FB-4E74-40F7-B523-B71FFB681B6D"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}