Executive brief
A vulnerability was identified in the Linux kernel's Optimized Media File System (OMFS) driver. An attacker could use a specially crafted filesystem image to cause a memory corruption event when the system attempts to mount or process the disk. This could lead to a complete system crash or allow an attacker to gain unauthorized control over the operating system.
Technical details
An integer underflow vulnerability exists in the fs/omfs component of the Linux kernel. The function omfs_fill_super() failed to validate that the s_sys_blocksize value was at least as large as OMFS_DIR_START (440 bytes). When a crafted image with a smaller block size is processed, the subsequent call to omfs_make_empty() performs a subtraction that underflows a u32 value, resulting in a massive (~4 GiB) memset() operation. This results in an out-of-bounds write that overwrites critical kernel memory. The issue has been resolved by adding a lower-bound check during superblock validation.
Affected products
- Linux Linux a3ab7155ea21 to 0621c385fda1
Timeline
- 2026-03-17: patched: Initial fix committed to mainline kernel
- 2026-06-24: advisory: CVE-2026-53130 published
References
- https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14
- https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51
- https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3
- https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6
- https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07
- https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644
- https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03