VulnerabilityPublished 25 Sep 2026Updated 19 Oct 2026

CVE-2026-97927: Linux kernel · ufs: create the root dentry after loading cylinder metadata

Affects Linux kernelSource CVE Database V5

Not known to be exploited · fixed in e58db6c2dce6e453dca26c3a4953002425201880 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 14:05 UTC

Severity

Medium

Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD

EPSS: 0.2% chance of exploitation in 30 days – higher than 11% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in e58db6c2dce6e453dca26c3a4953002425201880, cd21f1ff74b1c15077fa3b98e80da3b41055aae4, a9804121d55aaa4319c1cac00b99794aa177dd6a +5

Exploitation evidence

Disclosed: evidence found.
CVE published 25 Sep 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < e58db6c2dce6e453dca26c3a4953002425201880	Fixed in e58db6c2dce6e453dca26c3a4953002425201880
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < cd21f1ff74b1c15077fa3b98e80da3b41055aae4	Fixed in cd21f1ff74b1c15077fa3b98e80da3b41055aae4
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < a9804121d55aaa4319c1cac00b99794aa177dd6a	Fixed in a9804121d55aaa4319c1cac00b99794aa177dd6a
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 8173e051a8acbb4ae6547be0436727944119e0b5	Fixed in 8173e051a8acbb4ae6547be0436727944119e0b5
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 05360c6eb8388bb5adac3c439ffb1512de39550a	Fixed in 05360c6eb8388bb5adac3c439ffb1512de39550a
LinuxLinux	Affected ≥ 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, < 785e523b6c1931d802cab9f85912f3e6c7028af1	Fixed in 785e523b6c1931d802cab9f85912f3e6c7028af1

AI-suggested

A fix is available and has been applied in the Linux kernel. Users should update to a kernel version that includes the fix identified by the commits listed in establishedFacts.fixedVersions. No additional mitigation steps are necessary once patched.

Description

A vulnerability in the Linux kernel's UFS filesystem code caused a kernel oops during mount failure due to improper ordering of root dentry creation and cylinder metadata loading. This occurs when reading cylinder group structures fails, leading to a use-after-free scenario during superblock teardown.

Impact

A mount operation that fails while reading cylinder group metadata can cause a kernel oops (crash) during teardown, potentially leading to denial of service. The issue arises from a use-after-free condition in the UFS filesystem code path during mount failure.

Summary

The Linux kernel's ufs_fill_super() function installed the root dentry (sb->s_root) before loading the cylinder group metadata. If ufs_read_cylinder_structures() failed, the error path freed the superblock's in-core information and set sb->s_fs_info to NULL, but sb->s_root remained installed. This caused deactivate_locked_super() to call generic_shutdown_super(), which dereferenced a now NULL UFS_SB(sb), resulting in a kernel oops during mount teardown. The fix reorders operations to load cylinder group metadata first and create the root dentry last, ensuring the superblock is fully set up before being published to the VFS.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 26 Oct 2026, 13:23 UTC

Technical details

References

Community reviews

Related threats