CVE-2026-53320: nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: reject zero bdoblocknr in nilfsioctlmarkblocksdirty()
nilfsioctlmarkblocksdirty() uses bdoblocknr to detect dead blocks by comparing it with the current block number bdblocknr. If they differ, the block is considered dead and skipped.
However, bdoblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bdoblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bdblocknr to 0, bypassing the dead block check and calling nilfsbmapmark() on a non-existent block. This causes nilfsbtreedolookup() to return -ENOENT, triggering the WARNON(ret == -ENOENT).
Fix this by rejecting ioctl requests with bdoblocknr set to 0 at the beginning of each iteration.
[ryusuke: slightly modified the commit message and comments for accuracy]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In nilfs_ioctl_mark_blocks_dirty(), reject nilfs_ioctl_mark_blocks_dirty() ioctl requests when bd_oblocknr is set to 0, since block 0 (primary superblock) is never a valid GC target block and zero bypasses the -ENOENT dead-block handling.
Linux kernel (nilfs2) bd_oblocknr = reject requests where bd_oblocknr == 0
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53320?
CVE-2026-53320 has a severity score of 15, indicating a high level of risk.
How do I fix CVE-2026-53320?
To fix CVE-2026-53320, ensure that you are using the patched version of the Linux kernel that addresses this vulnerability.
What systems are affected by CVE-2026-53320?
CVE-2026-53320 affects systems running the Linux kernel that utilizes the nilfs2 file system.
What does CVE-2026-53320 exploit?
CVE-2026-53320 exploits a flaw in nilfs_ioctl_mark_blocks_dirty() where zero bd_oblocknr is not properly handled.
Is CVE-2026-53320 already resolved?
Yes, CVE-2026-53320 has been resolved in a recent update to the Linux kernel.