CVE-2026-53320: nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

Published Jun 26, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject zero bdoblocknr in nilfsioctlmarkblocksdirty()

nilfsioctlmarkblocksdirty() uses bdoblocknr to detect dead blocks by comparing it with the current block number bdblocknr. If they differ, the block is considered dead and skipped.

However, bdoblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bdoblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bdblocknr to 0, bypassing the dead block check and calling nilfsbmapmark() on a non-existent block. This causes nilfsbtreedolookup() to return -ENOENT, triggering the WARNON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bdoblocknr set to 0 at the beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

Affected Software

8 affected components
Linux Linux kernel
Linux Linux kernel>=2.6.30<5.10.258
Linux Linux kernel>=5.11<5.15.209
Linux Linux kernel>=5.16<6.1.175
Linux Linux kernel>=6.2<6.6.141
Linux Linux kernel>=6.7<6.12.91
Linux Linux kernel>=6.13<6.18.33
Linux Linux kernel>=6.19<7.0.10

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    In nilfs_ioctl_mark_blocks_dirty(), reject nilfs_ioctl_mark_blocks_dirty() ioctl requests when bd_oblocknr is set to 0, since block 0 (primary superblock) is never a valid GC target block and zero bypasses the -ENOENT dead-block handling.

    Linux kernel (nilfs2) bd_oblocknr = reject requests where bd_oblocknr == 0

Event History

Jun 26, 2026
CVE Published
via MITRE·07:41 PM
Data Sourced
via MITRE·07:41 PM
Description
Data Sourced
via NVD·08:17 PM
RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2026-53320?

CVE-2026-53320 has a severity score of 15, indicating a high level of risk.

2

How do I fix CVE-2026-53320?

To fix CVE-2026-53320, ensure that you are using the patched version of the Linux kernel that addresses this vulnerability.

3

What systems are affected by CVE-2026-53320?

CVE-2026-53320 affects systems running the Linux kernel that utilizes the nilfs2 file system.

4

What does CVE-2026-53320 exploit?

CVE-2026-53320 exploits a flaw in nilfs_ioctl_mark_blocks_dirty() where zero bd_oblocknr is not properly handled.

5

Is CVE-2026-53320 already resolved?

Yes, CVE-2026-53320 has been resolved in a recent update to the Linux kernel.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203