Executive brief
A vulnerability in the Linux kernel's NILFS2 file system could allow a local user to crash the system. The issue occurs during specific garbage collection operations immediately after the file system is mounted. This results in a system-wide denial of service, potentially disrupting operations and requiring a reboot.
Technical details
A NULL pointer dereference exists in the NILFS2 file system implementation within the Linux kernel. The DAT inode's btree node cache (i_assoc_inode) is lazily initialized, but the nilfs_mdt_save_to_shadow_map() function assumes it is already populated during garbage collection. If a local attacker triggers the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting the file system—before any btree operations occur—the kernel attempts to dereference the NULL i_assoc_inode, resulting in a general protection fault. The fix involves ensuring the btree node cache is attached during the initial DAT inode read at mount time.
Affected products
- Linux Linux Kernel up to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
References
- https://git.kernel.org/stable/c/41de342278ae025c99cc8d33648773f05e306cf1
- https://git.kernel.org/stable/c/449ec5fc99f45974525ba9eea16b6670c45cd363
- https://git.kernel.org/stable/c/4a4e0328edd9e9755843787d28f16dd4165f8b48
- https://git.kernel.org/stable/c/6637bbcfb59df5b732a79e5ab1a74886a0b93d59
- https://git.kernel.org/stable/c/7318e3549518ce8f14776a489d86488d80d7e2c8
- https://git.kernel.org/stable/c/7902b1df1520a0880bcda7a3704cfacd17905a83
- https://git.kernel.org/stable/c/837c7a59fb58f81b0db33848357f6a5d0d1250ad