{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-43067",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-43067",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-05-05T15:23:26.717Z",
    "updatedAt": "2026-10-19T19:06:12.380Z",
    "importedAt": "2026-10-24T01:58:08.712Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "ext4: handle wraparound when searching for blocks for indirect mapped blocks",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\next4: handle wraparound when searching for blocks for indirect mapped blocks\n\nCommit 4865c768b563 (\"ext4: always allocate blocks only from groups\ninode can use\") restricts what blocks will be allocated for indirect\nblock based files to block numbers that fit within 32-bit block\nnumbers.\n\nHowever, when using a review bot running on the latest Gemini LLM to\ncheck this commit when backporting into an LTS based kernel, it raised\nthis concern:\n\n   If ac->ac_g_ex.fe_group is >= ngroups (for instance, if the goal\n   group was populated via stream allocation from s_mb_last_groups),\n   then start will be >= ngroups.\n\n   Does this allow allocating blocks beyond the 32-bit limit for\n   indirect block mapped files? The commit message mentions that\n   ext4_mb_scan_groups_linear() takes care to not select unsupported\n   groups. However, its loop uses group = *start, and the very first\n   iteration will call ext4_mb_scan_group() with this unsupported\n   group because next_linear_group() is only called at the end of the\n   iteration.\n\nAfter reviewing the code paths involved and considering the LLM\nreview, I determined that this can happen when there is a file system\nwhere some files/directories are extent-mapped and others are\nindirect-block mapped.  To address this, add a safety clamp in\next4_mb_scan_groups().",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "9d89b9d55e25cb340c5b4b769876edc551b7a9ff",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f89bba144938921a2249237ad04a0183ff3f8930"
            },
            {
              "version": "1b0edd6022a3f44ce87fea9959a9310f4628fbea",
              "status": "affected",
              "versionType": "git",
              "lessThan": "83170a05908b6cf2fb3235d3065bf613ff866f3c"
            },
            {
              "version": "9eea2f57d11b30049ff996ac3eff6e0dc8089e5f",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4bec4a498ce86314d470ae6144120461f2138c29"
            },
            {
              "version": "34c803edc0b3365a42efcf9815acab63b4cf54e0",
              "status": "affected",
              "versionType": "git",
              "lessThan": "12624c5b724a81e14e532972b40d863b0de3b7d1"
            },
            {
              "version": "321ed8d559c951e71ad2d2d69a4cf0445644e865",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2a368ccddfc492a0aa951e2caef2985f20e96503"
            },
            {
              "version": "4865c768b563deff1b6a6384e74a62f143427b42",
              "status": "affected",
              "versionType": "git",
              "lessThan": "bb81702370fad22c06ca12b6e1648754dbc37e0f"
            },
            {
              "version": "16fce6b6c0b247258c6c217fce5a48abf50f6964",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "5.15.203",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "5.16"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "6.1.167",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.1.168"
            },
            {
              "version": "6.6.130",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.6.134"
            },
            {
              "version": "6.12.77",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.12.80"
            },
            {
              "version": "6.18.14",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.18.21"
            },
            {
              "version": "6.19.4",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "6.19.11"
            }
          ]
        }
      ]
    }
  }
}