In the Linux kernel, the following vulnerability has been resolved:

minix: avoid overflow in bitmap block count calculation

minix_check_superblock() uses minix_blocks_needed() to verify that the
on-disk imap and zmap block counts are large enough for the advertised
inode and zone counts.

The helper currently performs DIV_ROUND_UP() in unsigned int arithmetic.
A Minix v3 image can set s_ninodes or s_zones near UINT_MAX so the
addition inside DIV_ROUND_UP() wraps to zero. That makes a zero imap/zmap
block count look valid, after which minix_fill_super() can dereference
s_imap[0] or s_zmap[0] even though no bitmap buffers were allocated.

Impact: mounting a crafted Minix v3 image whose s_ninodes or s_zones is
near UINT_MAX makes minix_check_superblock() accept a zero bitmap-block
count and minix_fill_super() dereference s_imap[0]/s_zmap[0], panicking
the kernel.

The divisor is the bitmap capacity in bits, blocksize * 8, which is
always a power of two: minix_fill_super() obtains the block size through
sb_set_blocksize(), and blk_validate_block_size() rejects any size that
is not a power of two. Use DIV_ROUND_UP_POW2(), which divides before
adding the round-up term and so cannot overflow for a power-of-two
divisor.

https://git.kernel.org/stable/c/8a29e60e2176b02e04f8737c8b32b696230eb0c5

https://git.kernel.org/stable/c/959c95340a9e19cd333b4c18935fdeecbb2f319d

https://git.kernel.org/stable/c/a11ebaab50d27d6c4c78506f84ff36452e0b901d

https://git.kernel.org/stable/c/abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5

https://git.kernel.org/stable/c/fb3e566cafc38fe3ba35e6843a2d529a3748870c

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/minix/minix.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2bb588cede1c1969e49c0a2822c8cb8b346b7682","lessThan":"a11ebaab50d27d6c4c78506f84ff36452e0b901d","versionType":"git","status":"affected"},{"version":"f57ccd4657c7f082dc47e5b9e18a883bb5f9118f","lessThan":"959c95340a9e19cd333b4c18935fdeecbb2f319d","versionType":"git","status":"affected"},{"version":"31fefc18096cdc5549cfa54964d90e0b3229aedc","lessThan":"abe3536a4bedcc43de80b6d4d7e3d57e9ba382a5","versionType":"git","status":"affected"},{"version":"8c97a6ddc95690a938ded44b4e3202f03f15078c","lessThan":"8a29e60e2176b02e04f8737c8b32b696230eb0c5","versionType":"git","status":"affected"},{"version":"8c97a6ddc95690a938ded44b4e3202f03f15078c","lessThan":"fb3e566cafc38fe3ba35e6843a2d529a3748870c","versionType":"git","status":"affected"},{"version":"a051ecf5c5b0387840dc210413ed3bc7fbdaa69c","versionType":"git","status":"affected"},{"version":"d791c544efd6b9c944b43cf7f502e5bcb02fb941","versionType":"git","status":"affected"},{"version":"66c7c239c65341f99ae388d4d53dc9df2bcb9925","versionType":"git","status":"affected"},{"version":"1efc128ee4adbc23e082715425ff895449d233bc","versionType":"git","status":"affected"},{"version":"6.6.128","lessThan":"6.6.145","versionType":"semver","status":"affected"},{"version":"6.12.75","lessThan":"6.12.97","versionType":"semver","status":"affected"},{"version":"6.18.16","lessThan":"6.18.40","versionType":"semver","status":"affected"},{"version":"5.10.252","lessThan":"5.11","versionType":"semver","status":"affected"},{"version":"5.15.202","lessThan":"5.16","versionType":"semver","status":"affected"},{"version":"6.1.165","lessThan":"6.2","versionType":"semver","status":"affected"},{"version":"6.19.6","lessThan":"6.20","versionType":"semver","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/minix/minix.h"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"7.0","status":"affected"},{"version":"0","lessThan":"7.0","versionType":"semver","status":"unaffected"},{"version":"6.6.145","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.97","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.40","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.5","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc2","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]