CVE-2026-72369

CVE-2026-72369 is an integer overflow in the Minix filesystem driver's superblock validation. When mounting a crafted Minix v3 image with a UINT_MAX inode count, the calculation for required bitmap blocks wraps around, resulting in zero allocation for the inode and zone bitmaps. The subsequent dereference of s_imap[0] and s_zmap[0] triggers a kernel panic. The overflow itself is textbook unsigned wraparound. What makes this worth your attention is the attack surface and blast radius. Mount operations on untrusted images are reachable from container workloads, VM guests, and any code that can trigger image mounting — this isn't network-adjacent code, it's filesystem metadata parsing that lives in the same threat model as parsing untrusted packets. In cloud environments where tenants share hypervisors, an unhandled panic in a guest kernel is a denial-of-service vector against isolation boundaries. The CVSS 7.8 score undersells this: the failure mode is a NULL-adjacent dereference, not merely a crash. The fix replaces DIV_ROUND_UP() with DIV_ROUND_UP_POW2(), which exploits that the block size is always a power of two (enforced by blk_validate_block_size() one layer away). This prevents overflow because the optimized macro performs the addition before the division — the power-of-two property guarantees no intermediate overflow. It works, but understand what you're inheriting: minix_check_superblock() now silently depends on a block layer invariant it never explicitly validated. If that invariant changes during future refactoring, this fix silently produces wrong results rather than failing visibly. For your prioritization: this is a mount-time trigger, so audit any code paths that can mount Minix images from untrusted sources. If Minix support is loadable and not required in your environment, removing the module eliminates the attack surface entirely. If you must retain it, ensure your kernel is patched — the vulnerability is straightforward to trigger with a modified disk image, and the panic is immediate.

Reviewed through automated stages and approved by a human before publication.