CVE-2026-55392 describes an improper validation vulnerability in the nilfs_sb_is_valid() function of nilfs-utils up to version 2.3.0. The function fails to properly validate the s_log_block_size field before performing bit-shift operations. Attackers can supply specially crafted NILFS2 images that trigger oversized bit-shifts or out-of-memory conditions, causing undefined behavior and crashing utilities like nilfs-tune and dumpseg. The vulnerability is fixed in commit 26efb5d, but no explicit patch or vendor advisory is provided in the input data.

The vulnerability can cause denial of service by crashing nilfs-utils tools when processing malicious NILFS2 images. There is no indication of privilege escalation or data corruption beyond the crash. The CVSS 4.0 score is 6.7 (medium severity), reflecting local attack vector with low complexity but requiring user interaction and resulting in high impact on availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vulnerability is fixed in commit 26efb5d, so applying the corresponding update or patch from the nilfs-utils project is recommended once available. Until then, avoid processing untrusted NILFS2 images with affected versions.