Executive brief
A bug in the Linux kernel's NILFS2 filesystem can cause a memory corruption error when truncating files. The filesystem fails to properly clean up internal tree structures during truncation, leaving orphaned data that triggers unsafe memory access. This can lead to system crashes or potential code execution on systems using NILFS2.
Technical details
A slab-out-of-bounds vulnerability exists in nilfs_direct_propagate() within the NILFS2 filesystem implementation. The root cause is improper cleanup of B-tree node blocks when a B-tree mapping collapses into a direct mapping during file truncation. After truncation, an intermediate node block pointed to by the root node remains in the cache in a dirty state. The log writer then incorrectly invokes nilfs_direct_propagate() on this B-tree node, designed only for data blocks, causing out-of-bounds access due to virtual block numbers exceeding direct mapping ranges. The vulnerability is triggered during file truncation operations on NILFS2 filesystems. A patch adds explicit deletion of residual node structures via a nilfs_btree_discard() operation with a 'deform' flag to properly clean up during mapping transformation.
Affected products
- Linux Linux kernel <UNKNOWN>
Timeline
- 2026-09-11: disclosed
- 2026-09-11: patched: Patch adds nilfs_btree_discard() operation for proper cleanup