Executive brief
A file system maintenance operation (garbage collection) in Linux's nilfs2 module failed to validate certain parameters, allowing an attacker to pass invalid block indices that corrupt kernel memory structures. This causes crashes and potential system instability. The issue affects systems using nilfs2, a log-structured file system typically used in embedded or specialized deployments.
Technical details
The vulnerability is an input validation flaw in the nilfs2 garbage collection (GC) ioctl handler. The GC ioctl accepts a nilfs_vdesc structure containing 'vd_offset' and 'vd_vblocknr' parameters that determine a page index inserted into the page cache. The vulnerable code in nilfs_ioctl_move_inode_block() failed to check whether these values would cause the page index to exceed ULONG_MAX, resulting in index wrap-around. When a crafted ioctl request specifies an index of ULONG_MAX, the filemap_get_folios_tag() function repeatedly detects the same dirty folio due to wrap-around, causing double list_add_tail() operations on the same buffer and corrupting the kernel's linked-list structures. This requires local access to invoke the ioctl but does not require elevated privileges if the file system is accessible. The fix adds range checks ensuring vd_vblocknr and vd_offset remain below a calculated limit derived from the inode's superblock maxbytes.
Affected products
- Linux Linux kernel affected versions prior to fix commit a1735eae55448bc79c2da6593455791e886f6ed8
Timeline
- 2026-09-04: disclosed
- 2026-08-25: patched