CVE-2026-97488
Description
A flaw was found in the Linux kernel. The QNX4 filesystem driver fails to properly handle errors when setting the block size during mount operations. A local attacker could exploit this vulnerability by mounting a crafted filesystem image with an invalid block size, triggering a kernel crash that results in a Denial of Service (DoS).
Statement
A low impact denial of service vulnerability was found in the Linux kernel QNX4 filesystem driver. The driver fails to handle errors returned when setting the filesystem block size during a mount operation, and qnx4 uses buffer heads, which do not handle block sizes larger than PAGE_SIZE well. A local attacker with privileges sufficient to mount a crafted QNX4 filesystem image with an invalid block size could trigger a BUG_ON assertion in folio_set_bh on the first buffer read, crashing the kernel and causing a local denial of service. Only availability is affected; confidentiality and integrity are not. Red Hat rates the impact of this flaw as low because exploitation requires privileged local access to mount filesystems, even though the calculated CVSS:3.1 score is 5.5. No Red Hat products are affected by this flaw: the Red Hat Enterprise Linux, Red Hat In-Vehicle OS, and OpenShift Container Platform streams listed for this flaw are marked not affected because the vulnerable code is not present in the shipped kernels, and the Red Hat Enterprise Linux 6 Extended Lifecycle Support stream is out of support scope.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
An attacker that can trigger an assert statement can still lead to a denial of service if the relevant code can be triggered by an attacker, and if the scope of the assert() extends beyond the attacker's own session.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
