---
id: CVE-2026-52992
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/adfs: validate nzones in adfs_validate_bblk()

  Reject ADFS disc records with a zero zone count during boot block
  validation, before the disc record is used.

  When nz…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  fs/adfs: validate nzones in adfs_validate_bblk()

  Reject ADFS disc records with a zero zone count during boot block
  validation, before the disc record is used.

  When nz…
severity: none
published: '2026-06-24'
updated: '2026-07-10'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-52992'
references:
  - url: 'https://git.kernel.org/stable/c/1586bd2d2fb436a26df20a70e78b000d34a7d159'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/1f0ed0f57f0fc87e46fe19a05435c214dc464be2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/33aafd2418a59c96c0389d47ea09026661fa9ec6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/60d82592ac8b5637fbed871381eb0a16df0a492e'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6ff8cca5cdb4f2e0ea6d28ecd78479dd3f221ebc'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a11372a8b1ceaa5e950a84b3b5fbf8228f25e277'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a3fd5dc1c7b0aae947a67dc2e2c037d57557a4de'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/dd9d3e16c2d5fa166e13dce07413be51f42c8f5d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.00176
epssPercentile: 0.06311
ingestedAt: '2026-07-11T13:13:25.632Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

fs/adfs: validate nzones in adfs_validate_bblk()

Reject ADFS disc records with a zero zone count during boot block
validation, before the disc record is used.

When nzones is 0, adfs_read_map() passes it to kmalloc_array(0, ...)
which returns ZERO_SIZE_PTR, and adfs_map_layout() then writes to
dm[-1], causing an out-of-bounds write before the allocated buffer.

adfs_validate_dr0() already rejects nzones != 1 for old-format
images.  Add the equivalent check to adfs_validate_bblk() for
new-format images so that a crafted image with nzones == 0 is
rejected at probe time.

Found by syzkaller.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.