CVE-2026-90418: nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Published Sep 17, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix BUG in nilfscopydirtypages() on dirty state mismatch

Syzbot reported a kernel BUG triggered within nilfscopydirtypages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status.

This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode.

Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

Affected Software

1 affected component
Linux Linux kernel

Event History

Sep 17, 2026
CVE Published
via MITRE·04:09 PM
Data Sourced
via MITRE·04:09 PM
Description

Frequently Asked Questions

1

Which systems are exposed to this issue?

The issue applies to Linux kernel systems using the NILFS2 filesystem. The triggering condition involves NILFS2 detecting metadata corruption, transitioning to read-only mode, and asynchronously clearing the dirty state of a folio or page while dirty DAT pages are being copied.

2

How can an operator recognize that this issue has occurred?

Affected systems can trigger a kernel BUG within nilfs_copy_dirty_pages() when a retrieved dirty folio or page no longer has its dirty status. With the resolved behavior, a read-only filesystem state causes an -EROFS error instead, while an unexpected dirty-state mismatch outside read-only mode produces a warning only once.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203