CVE-2026-97927

In the Linux kernel, the following vulnerability has been resolved:

ufs: create the root dentry after loading cylinder metadata

ufs fill super() installed sb->s root before it loaded the cylinder group structures for a writable mount:

sb->s root = d make root(inode);
...
if (!sb rdonly(sb))
	if (!ufs read cylinder structures(sb))
		goto failed;

When ufs read cylinder structures() failed, the error path freed the in-core superblock information and set sb->s fs info to NULL while sb->s root stayed installed. get tree bdev() then reached deactivate locked super(), and because s root was present, generic shutdown super() called sync filesystem() and the put super operation. Both dereference UFS SB(sb), which is now NULL, so a mount that fails only while reading the cylinder groups oopses during teardown. A crafted image whose first cylinder group cannot be read reaches this path.

Load the cylinder group metadata first and create the root dentry last, so the superblock is published to the VFS only once it is fully set up. ufs setup cstotal() and ufs read cylinder structures() take only the super block and do not use the root inode, so the reordering is safe.