Executive brief
A vulnerability exists in the Linux kernel's JFS file system component, which is used for managing data storage. Under specific conditions involving directory renaming, the system can experience an internal error that leads to a system warning or potential instability. This could allow a local user to cause a denial of service by triggering a crash or system hang.
Technical details
An integer overflow/wrap-around vulnerability exists in the jfs_rename function within fs/jfs/namei.c of the Linux kernel. When a directory's link count (nlink) is at its maximum value (-1) and a rename operation is performed on a child directory within that same parent, the kernel incorrectly increments and then decrements the nlink value. This causes the value to wrap around to zero, triggering a warning in drop_nlink and potentially leading to file system corruption or a denial of service. The issue has been resolved by adding checks to ensure nlink is only modified when the directory is actually moving between different parent directories. Patches are available for various stable kernel branches including 5.10.y, 5.15.y, 6.1.y, and 6.6.y.
Affected products
- Linux Linux Kernel 2.6.12 through 6.12.y
Timeline
- 2025-10-28: disclosed: Vulnerability reported and patch authored by Jori Koolstra
- 2025-12-02: patched: Mainline patch committed by Dave Kleikamp
- 2026-05-06: advisory: NVD advisory published
References
- https://git.kernel.org/stable/c/2108829a59f081e822fdab8c2cd7131deb8aa8a1
- https://git.kernel.org/stable/c/5d77c36cd4b698649f5c30c5f6c084f4f61d1880
- https://git.kernel.org/stable/c/9218dc26fd922b09858ecd3666ed57dfd8098da8
- https://git.kernel.org/stable/c/93c325746ae59709b4f9bad4e3e4761c8d566c70
- https://git.kernel.org/stable/c/a3d66089e50a6e0142f8884471f74292102ea9aa
- https://git.kernel.org/stable/c/b4330a0d0947fbdc9d445cbbeabd8cc910a8c9ca
- https://git.kernel.org/stable/c/f70fcbc2ac7c24f087a2c895c5753aa730b1e479