CVE-2026-90419: nilfs2: prevent out-of-bounds read in super root block parsing
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: prevent out-of-bounds read in super root block parsing
super-root inode metadata size is trusted before nilfsreadinodecommon().
Reject super-root inode sizes whose computed on-disk footprint exceeds the filesystem block size. This prevents malformed filesystem images from making nilfsreadinodecommon() read past the end of the super-root block.
[ryusuke: clarify the commit title]
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Systems that parse or mount a malformed NILFS2 filesystem image are exposed. The vulnerable path handles super-root block parsing in the Linux kernel.
What does an attacker need to trigger the out-of-bounds read?
An attacker needs a malformed filesystem image with super-root inode metadata whose computed on-disk footprint exceeds the filesystem block size. The malformed metadata can cause nilfs_read_inode_common() to read beyond the end of the super-root block.
How can I tell whether a fix is present?
The fix rejects super-root inode sizes when their computed on-disk footprint exceeds the filesystem block size before calling nilfs_read_inode_common(). The provided stable references identify commits containing the resolution.