Junglewise Threat Intelligence

CVE-2026-31577: Linux Kernel NILFS2 NULL pointer dereference in nilfs_mdt_save_to_shadow_map

CVE-2026-31577 · Severity: medium · CVSS 5.5 · Published 2026-04-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's NILFS2 file system could allow a local user to crash the system. The issue occurs during specific garbage collection operations immediately after the file system is mounted. This results in a system-wide denial of service, potentially disrupting operations and requiring a reboot.

Technical details

A NULL pointer dereference exists in the NILFS2 file system implementation within the Linux kernel. The DAT inode's btree node cache (i_assoc_inode) is lazily initialized, but the nilfs_mdt_save_to_shadow_map() function assumes it is already populated during garbage collection. If a local attacker triggers the NILFS_IOCTL_CLEAN_SEGMENTS ioctl immediately after mounting the file system—before any btree operations occur—the kernel attempts to dereference the NULL i_assoc_inode, resulting in a general protection fault. The fix involves ensuring the btree node cache is attached during the initial DAT inode read at mount time.

Affected products

  • Linux Linux Kernel up to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1

Timeline

  • 2026-04-24: disclosed
  • 2026-04-24: advisory

References

Related threats