Medium 5.5Published May 6, 2026

CVE-2026-43209minix: Add required sanity checking to minix_check_superblock()

Updated under an hour ago (Oct 27, 2026, 10:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: minix: Add required sanity checking to minix_check_superblock() The fs/minix implementation of the minix filesystem does not currently support any other value for s_log_zone_size than 0. This is also the only value supported in util-linux; see mkfs.minix.c line 511. In addition, this patch adds some sanity checking for the other minix superblock fields, and moves the minix_blocks_needed() checks for the zmap and imap also to minix_check_super_block(). This also closes a related syzbot bug report.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before a051ecf5c5b0387840dc210413ed3bc7fbdaa69c; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before d791c544efd6b9c944b43cf7f502e5bcb02fb941; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 66c7c239c65341f99ae388d4d53dc9df2bcb9925; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 2bb588cede1c1969e49c0a2822c8cb8b346b7682; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before f57ccd4657c7f082dc47e5b9e18a883bb5f9118f; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 31fefc18096cdc5549cfa54964d90e0b3229aedc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 1efc128ee4adbc23e082715425ff895449d233bc; from 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 before 8c97a6ddc95690a938ded44b4e3202f03f15078c	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.12.1 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.16; from 6.19 before 6.19.6; 2.6.12; and 5 more ranges	NVD

References

References

https://git.kernel.org/stable/c/a051ecf5c5b0387840dc210413ed3bc7fbdaa69c	patch
https://git.kernel.org/stable/c/d791c544efd6b9c944b43cf7f502e5bcb02fb941	patch
https://git.kernel.org/stable/c/66c7c239c65341f99ae388d4d53dc9df2bcb9925	patch
https://git.kernel.org/stable/c/2bb588cede1c1969e49c0a2822c8cb8b346b7682	patch
https://git.kernel.org/stable/c/f57ccd4657c7f082dc47e5b9e18a883bb5f9118f	patch
https://git.kernel.org/stable/c/31fefc18096cdc5549cfa54964d90e0b3229aedc	patch
https://git.kernel.org/stable/c/1efc128ee4adbc23e082715425ff895449d233bc	patch
https://git.kernel.org/stable/c/8c97a6ddc95690a938ded44b4e3202f03f15078c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.