Executive brief
The Linux kernel's nilfs2 filesystem contains a bug in the segment cleaner component that can cause a hung task and service degradation. When a storage device is remounted read-only (e.g., after an I/O error), the cleaner thread enters an infinite loop instead of properly aborting, consuming system resources and preventing normal operation. This can lead to system hangs and denial of service.
Technical details
The vulnerability is a logic error (infinite loop) in the nilfs_clean_segments() function within the nilfs2 filesystem driver. The root cause is that when nilfs_segctor_construct() returns -EROFS (read-only filesystem error), the error handling code logs the error and sleeps but fails to break out of the retry loop, causing the cleaner thread to loop indefinitely. The fix adds an explicit check to abort the loop when -EROFS is encountered, matching the behavior of the related nilfs_segctor_write_out() function. This is triggered locally by a device state change and requires no special privileges or network access. The patch has been merged into the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions (nilfs2 filesystem module)
Timeline
- 2026-09-17: disclosed: CVE published
- 2026-09-14: patched: Fix merged into Linux kernel stable tree