Executive brief
A vulnerability in the NILFS2 file system utilities could allow a system crash or denial-of-service. By providing a specially crafted file system image, such as on a USB drive, an attacker can cause administrative tools like nilfs-tune to crash or consume all available system memory. This primarily impacts the availability of the system and the reliability of file system management operations.
Technical details
A vulnerability exists in the nilfs_sb_is_valid() function within nilfs-utils through version 2.3.0. The function fails to validate the s_log_block_size field in the NILFS2 superblock before it is used in bit-shift operations and memory allocation calculations. An attacker can provide a crafted NILFS2 image (e.g., via a malicious storage device) that specifies an invalid block size. This triggers undefined behavior via oversized shifts or causes a denial-of-service (DoS) through excessive memory allocation (OOM) in tools such as nilfs-tune, dumpseg, and the garbage collector. The issue is fixed in commit 26efb5d by enforcing a valid range of 0-6 for the s_log_block_size field.
Affected products
- nilfs-dev nilfs-utils 0 through 2.3.0
Timeline
- 2026-06-10: disclosed: Issue reported on GitHub repository
- 2026-06-18: advisory: CVE published to NVD
- 2026-06-18: patched: Fix committed to nilfs-utils repository