CVE-2026-31577: nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL iassocinode dereference in nilfsmdtsavetoshadowmap
The DAT inode's btree node cache (iassocinode) is initialized lazily during btree operations. However, nilfsmdtsavetoshadowmap() assumes iassocinode is already initialized when copying dirty pages to the shadow map during GC.
If NILFSIOCTLCLEANSEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, iassocinode is NULL leading to a general protection fault.
Fix this by calling nilfsattachbtreenodecache() on the DAT inode in nilfsdatread() at mount time, ensuring iassocinode is always initialized before any GC operation can use it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.137.1-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1 - Configuration
Initialize the DAT inode's btree node cache in nilfs_dat_read() at mount time so i_assoc_inode is initialized before any garbage-collection operation, including nilfs_mdt_save_to_shadow_map().
Linux kernel nilfs2 nilfs_dat_read() = Call nilfs_attach_btree_node_cache() on the DAT inode at mount time
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31577?
CVE-2026-31577 has been rated as a medium-severity vulnerability due to the potential for a NULL pointer dereference in affected Linux kernel versions.
How do I fix CVE-2026-31577?
To address CVE-2026-31577, users should update their Linux kernel to a version higher than 6.6.136 or within the specified safe ranges for their distribution.
Which Linux kernel versions are affected by CVE-2026-31577?
CVE-2026-31577 affects Linux kernel versions prior to or including 6.6.136 and versions between 6.7 and 7.0.1.
What is the nature of CVE-2026-31577's vulnerability?
CVE-2026-31577 involves a NULL pointer dereference in the nilfs_mdt_save_to_shadow_map function within the nilfs2 file system.
Is CVE-2026-31577 easily exploitable?
While CVE-2026-31577 could lead to system crashes, exploitation may require specific conditions or privileges that limit widespread risk.