Executive brief
A vulnerability in the Linux kernel's NILFS2 file system could allow a local user to cause a system hang or denial-of-service. By providing invalid inputs to a specific file system management command (ioctl), an attacker can trigger excessive internal logging that locks up the system's ability to perform basic file operations like changing file permissions. This results in a significant impact on system availability and operational stability.
Technical details
A vulnerability exists in the NILFS2 file system where user-supplied segment numbers in the NILFS_IOCTL_CLEAN_SEGMENTS ioctl are not validated before acquiring the ns_segctor_sem semaphore. When invalid segment numbers are provided, the kernel performs a range check deep within the call chain (nilfs_sufile_updatev), which emits a warning message via printk for every invalid entry while still holding the semaphore. Under high load or with many invalid entries, the cumulative latency of these printk operations causes the semaphore to be held long enough to trigger the hung_task watchdog, blocking other filesystem operations like chmod(). The fix introduces early validation of segment numbers immediately after the lock is acquired.
Affected products
- Linux Linux Kernel nilfs2 file system
Timeline
- 2026-05-03: other: Patch authored
- 2026-07-18: patched: Patch committed to stable tree
- 2026-07-25: advisory: CVE published
References
- https://git.kernel.org/stable/c/0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa
- https://git.kernel.org/stable/c/0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9
- https://git.kernel.org/stable/c/223463c488b0554212a94de971ea538eb2805fc7
- https://git.kernel.org/stable/c/286f77d002a337735c0846d7480a82d9cda2aa31
- https://git.kernel.org/stable/c/39607452b1400c7bf748f15122df4d058b768c5b
- https://git.kernel.org/stable/c/3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e
- https://git.kernel.org/stable/c/876c98e0fc65f071680c03c2e2ee3ef7ff9ca078