{"cve":"CVE-2026-43209","nvd":{"published":"2026-05-06T12:16:40.283","modified":"2026-06-17T10:49:09.467","status":"Analyzed","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nminix: Add required sanity checking to minix_check_superblock()\n\nThe fs/minix implementation of the minix filesystem does not currently\nsupport any other value for s_log_zone_size than 0. This is also the\nonly value supported in util-linux; see mkfs.minix.c line 511. In\naddition, this patch adds some sanity checking for the other minix\nsuperblock fields, and moves the minix_blocks_needed() checks for the\nzmap and imap also to minix_check_super_block().\n\nThis also closes a related syzbot bug report.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":5.5},"cwes":[],"references":["https://git.kernel.org/stable/c/1efc128ee4adbc23e082715425ff895449d233bc","https://git.kernel.org/stable/c/2bb588cede1c1969e49c0a2822c8cb8b346b7682","https://git.kernel.org/stable/c/31fefc18096cdc5549cfa54964d90e0b3229aedc","https://git.kernel.org/stable/c/66c7c239c65341f99ae388d4d53dc9df2bcb9925","https://git.kernel.org/stable/c/8c97a6ddc95690a938ded44b4e3202f03f15078c"],"products":["linux:linux_kernel"],"source":"nvd","synced_at":"2026-10-19T22:33:55.586217763+00:00"},"epss":{"cve":"CVE-2026-43209","score":0.00128,"percentile":0.02426,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}