Executive brief
A vulnerability was identified in the Linux kernel's NILFS2 file system. A specifically crafted request to the system could cause the kernel to attempt operations on non-existent data blocks, leading to internal warnings and potential system instability. This issue primarily affects systems using the NILFS2 file system and could be used by a local attacker to disrupt normal operations.
Technical details
A vulnerability exists in the NILFS2 implementation within the Linux kernel where nilfs_ioctl_mark_blocks_dirty() fails to reject a zero value for bd_oblocknr. In NILFS2, block 0 is reserved for the primary superblock and is not a valid target for garbage collection or marking as dirty. When a corrupted ioctl request provides a bd_oblocknr of 0, and a subsequent lookup returns -ENOENT (setting bd_blocknr to 0), the kernel incorrectly bypasses dead block checks. This results in nilfs_bmap_mark() being called on a non-existent block, triggering a WARN_ON in nilfs_btree_do_lookup(). The fix involves explicitly rejecting ioctl requests where bd_oblocknr is 0.
Affected products
- Linux Linux Kernel 7942b919f732 to be3e5d10643d3be1cbac9d9939f220a99253f980
Timeline
- 2026-06-26: disclosed
- 2026-06-26: advisory
References
- https://git.kernel.org/stable/c/4525658002be3ad310b16bf8db48c8adb6a55d32
- https://git.kernel.org/stable/c/65e07964b4b2daf9a54e686cf0fa72d74a9648a8
- https://git.kernel.org/stable/c/94094e70fe292c9566502772d4d4d6d6a99204b1
- https://git.kernel.org/stable/c/9472d37799a0b9ff9b99639f35961ac2f0b3c9be
- https://git.kernel.org/stable/c/b88f905d4449b70da6bda547be546e365e44352e
- https://git.kernel.org/stable/c/be3e5d10643d3be1cbac9d9939f220a99253f980
- https://git.kernel.org/stable/c/e0a0c4903cbba351f0f5b5d104960d3a5b23202f