Linux kernel nilfs2 ioctl zero bd_oblocknr abuse
CVE-2026-53320 Published on June 26, 2026
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()
nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks
by comparing it with the current block number bd_blocknr. If they differ,
the block is considered dead and skipped.
However, bd_oblocknr should never be 0 since block 0 typically stores the
primary superblock and is never a valid GC target block. A corrupted ioctl
request with bd_oblocknr set to 0 causes the comparison to incorrectly
match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing
the dead block check and calling nilfs_bmap_mark() on a non-existent
block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering
the WARN_ON(ret == -ENOENT).
Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the
beginning of each iteration.
[ryusuke: slightly modified the commit message and comments for accuracy]
Products Associated with CVE-2026-53320
stack.watch emails you whenever new vulnerabilities are published in Linux Kernel or Canonical Ubuntu Linux. Just hit a watch button to start following.
Affected Versions
Linux:- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below e0a0c4903cbba351f0f5b5d104960d3a5b23202f is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below 9472d37799a0b9ff9b99639f35961ac2f0b3c9be is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below 65e07964b4b2daf9a54e686cf0fa72d74a9648a8 is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below b88f905d4449b70da6bda547be546e365e44352e is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below 4525658002be3ad310b16bf8db48c8adb6a55d32 is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below e5ff0ba4b6983cdbcc826efc201e7179ece5d46f is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below 94094e70fe292c9566502772d4d4d6d6a99204b1 is affected.
- Version 7942b919f7321f95a777d396ff7894a7a83dc9b0 and below be3e5d10643d3be1cbac9d9939f220a99253f980 is affected.
- Version 2.6.30 is affected.
- Before 2.6.30 is unaffected.
- Version 5.10.258, <= 5.10.* is unaffected.
- Version 5.15.209, <= 5.15.* is unaffected.
- Version 6.1.175, <= 6.1.* is unaffected.
- Version 6.6.141, <= 6.6.* is unaffected.
- Version 6.12.91, <= 6.12.* is unaffected.
- Version 6.18.33, <= 6.18.* is unaffected.
- Version 7.0.10, <= 7.0.* is unaffected.
- Version 7.1, <= * is unaffected.
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.