CVE-2026-43067 - Vulnerability Details

- ext4: handle wraparound when searching for blocks for indirect mapped blocks

Description

In the Linux kernel, the following vulnerability has been resolved:

ext4: handle wraparound when searching for blocks for indirect mapped blocks

Commit 4865c768b563 ("ext4: always allocate blocks only from groups
inode can use") restricts what blocks will be allocated for indirect
block based files to block numbers that fit within 32-bit block
numbers.

However, when using a review bot running on the latest Gemini LLM to
check this commit when backporting into an LTS based kernel, it raised
this concern:

If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal
group was populated via stream allocation from s_mb_last_groups),
then start will be >= ngroups.

Does this allow allocating blocks beyond the 32-bit limit for
indirect block mapped files? The commit message mentions that
ext4_mb_scan_groups_linear() takes care to not select unsupported
groups. However, its loop uses group = *start, and the very first
iteration will call ext4_mb_scan_group() with this unsupported
group because next_linear_group() is only called at the end of the
iteration.

After reviewing the code paths involved and considering the LLM
review, I determined that this can happen when there is a file system
where some files/directories are extent-mapped and others are
indirect-block mapped. To address this, add a safety clamp in
ext4_mb_scan_groups().

Published: 2026-05-05

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The flaw resides in the ext4 block allocation logic for indirect‑mapped files, where unsupported block groups can be selected during a wraparound search. This oversight can cause block numbers to exceed the 32‑bit limit, potentially corrupting file system metadata and data. The vulnerability is a logical integer overflow and array bounds error (CWE‑190, CWE‑822).

Affected Systems

Linux kernels that include the ext4 file system implementation and lack the commit that clamps block allocations to 32‑bit values are affected. CPE data references the generic Linux kernel and version 6.1.167, but the issue applies to any kernel version older than the patch. No specific distribution names are disclosed; an audit of installed kernel versions is required to locate vulnerable systems.

Risk and Exploitability

The vulnerability carries a CVSS score of 9.8, indicating critical severity. The EPSS score is < 1 %, suggesting a low probability of exploitation. It is not listed in CISA’s KEV catalog. Based on the description, the attack vector likely requires local write access to an ext4 file system or the ability to create file system structures that trigger the allocation flaw, which could allow an attacker to corrupt data on the affected partitions.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9d89b9d55e25cb340c5b4b769876edc551b7a9ff`	affected	< f89bba144938921a2249237ad04a0183ff3f8930
`1b0edd6022a3f44ce87fea9959a9310f4628fbea`	affected	< 83170a05908b6cf2fb3235d3065bf613ff866f3c
`9eea2f57d11b30049ff996ac3eff6e0dc8089e5f`	affected	< 4bec4a498ce86314d470ae6144120461f2138c29
`34c803edc0b3365a42efcf9815acab63b4cf54e0`	affected	< 12624c5b724a81e14e532972b40d863b0de3b7d1
`321ed8d559c951e71ad2d2d69a4cf0445644e865`	affected	< 2a368ccddfc492a0aa951e2caef2985f20e96503
`4865c768b563deff1b6a6384e74a62f143427b42`	affected	< bb81702370fad22c06ca12b6e1648754dbc37e0f
`16fce6b6c0b247258c6c217fce5a48abf50f6964`	affected	—
`5.15.203`	affected	< 5.16

Linux

unaffected

Version	Status	Constraints
`6.1.167`	affected	< 6.1.168
`6.6.130`	affected	< 6.6.134
`6.12.77`	affected	< 6.12.80
`6.18.14`	affected	< 6.18.21
`6.19.4`	affected	< 6.19.11

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:6.1.167:::::::*

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9d89b9d55e25cb340c5b4b769876edc551b7a9ff,f89bba144938921a2249237ad04a0183ff3f8930)`	affected	code_commit	—
`[1b0edd6022a3f44ce87fea9959a9310f4628fbea,83170a05908b6cf2fb3235d3065bf613ff866f3c)`	affected	code_commit	—
`[9eea2f57d11b30049ff996ac3eff6e0dc8089e5f,4bec4a498ce86314d470ae6144120461f2138c29)`	affected	code_commit	—
`[34c803edc0b3365a42efcf9815acab63b4cf54e0,12624c5b724a81e14e532972b40d863b0de3b7d1)`	affected	code_commit	—
`[321ed8d559c951e71ad2d2d69a4cf0445644e865,2a368ccddfc492a0aa951e2caef2985f20e96503)`	affected	code_commit	—
`[4865c768b563deff1b6a6384e74a62f143427b42,bb81702370fad22c06ca12b6e1648754dbc37e0f)`	affected	code_commit	—
`[16fce6b6c0b247258c6c217fce5a48abf50f6964,*]`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[6.1.167,6.1.168)`	affected	semver	—
`[6.6.130,6.6.134)`	affected	semver	—
`[6.12.77,6.12.80)`	affected	semver	—
`[6.18.14,6.18.21)`	affected	semver	—
`[6.19.4,6.19.11)`	affected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the safety clamp in ext4_mb_scan_groups().
After upgrading, run a full filesystem check with e2fsck on all ext4 partitions to identify any corruption caused by prior allocation errors.
Until an upgrade is possible, restrict write access to ext4 filesystems for non‑trusted users or migrate critical data to a different filesystem that does not use the vulnerable allocation logic.

Generated by OpenCVE AI on October 23, 2026 at 07:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00504.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1
https://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503
https://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29
https://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c
https://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f
https://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930
https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43067-7366@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43067
https://www.cve.org/CVERecord?id=CVE-2026-43067

History

Mon, 19 Oct 2026 20:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-822

Fri, 16 Oct 2026 16:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Wed, 20 May 2026 23:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		NVD-CWE-noinfo
CPEs		cpe:2.3:o:linux:linux_kernel:6.1.167:::::::*

Fri, 08 May 2026 13:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Wed, 06 May 2026 12:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026050532-CVE-2026-43067-7366@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43067 https://www.cve.org/CVERecord?id=CVE-2026-43067
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Tue, 05 May 2026 18:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-190

Tue, 05 May 2026 16:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ext4: handle wraparound when searching for blocks for indirect mapped blocks Commit 4865c768b563 ("ext4: always allocate blocks only from groups inode can use") restricts what blocks will be allocated for indirect block based files to block numbers that fit within 32-bit block numbers. However, when using a review bot running on the latest Gemini LLM to check this commit when backporting into an LTS based kernel, it raised this concern: If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal group was populated via stream allocation from s_mb_last_groups), then start will be >= ngroups. Does this allow allocating blocks beyond the 32-bit limit for indirect block mapped files? The commit message mentions that ext4_mb_scan_groups_linear() takes care to not select unsupported groups. However, its loop uses group = *start, and the very first iteration will call ext4_mb_scan_group() with this unsupported group because next_linear_group() is only called at the end of the iteration. After reviewing the code paths involved and considering the LLM review, I determined that this can happen when there is a file system where some files/directories are extent-mapped and others are indirect-block mapped. To address this, add a safety clamp in ext4_mb_scan_groups().
Title		ext4: handle wraparound when searching for blocks for indirect mapped blocks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/12624c5b724a81e14e532972b40d863b0de3b7d1 https://git.kernel.org/stable/c/2a368ccddfc492a0aa951e2caef2985f20e96503 https://git.kernel.org/stable/c/4bec4a498ce86314d470ae6144120461f2138c29 https://git.kernel.org/stable/c/83170a05908b6cf2fb3235d3065bf613ff866f3c https://git.kernel.org/stable/c/bb81702370fad22c06ca12b6e1648754dbc37e0f https://git.kernel.org/stable/c/f89bba144938921a2249237ad04a0183ff3f8930

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-05T15:23:26.717Z

Updated: 2026-10-19T19:06:12.380Z

Reserved: 2026-05-01T14:12:55.981Z

Link: CVE-2026-43067

Vulnrichment

Updated: 2026-10-16T15:14:17.573Z

NVD

Status : Modified

Published: 2026-05-05T16:16:15.937

Modified: 2026-10-19T20:18:04.100

Link: CVE-2026-43067

Redhat

Severity : Moderate

Publid Date: 2026-05-05T00:00:00Z

Links: CVE-2026-43067 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-23T08:00:17Z

Weaknesses

CWE-190
Integer Overflow or Wraparound
CWE-822
Untrusted Pointer Dereference
NVD-CWE-noinfo

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object