CVE-2026-55392 describes an improper validation vulnerability in nilfs-utils (up to version 2.3.0) where the nilfs_sb_is_valid() function fails to validate the s_log_block_size field of the NILFS2 superblock before performing bit-shift operations. Attackers can supply specially crafted NILFS2 images that trigger oversized bit shifts or cause out-of-memory conditions, resulting in crashes of utilities like nilfs-tune and dumpseg. The vulnerability has a CVSS 4.0 base score of 6.7 (medium severity). A fix was introduced in commit 26efb5d, but no explicit vendor advisory or patch link is provided in the data.

The vulnerability can cause denial of service by crashing NILFS utilities such as nilfs-tune and dumpseg when processing malicious NILFS2 images. There is no indication of privilege escalation or data corruption beyond the crash and resource exhaustion effects.

A fix for this vulnerability exists in the form of commit 26efb5d, which properly validates the s_log_block_size field before bit-shift operations. Users should upgrade nilfs-utils to a version including this commit. Since no official vendor advisory or patch link is provided, users should verify the presence of this fix in their version or apply the patch manually. Patch status is not yet confirmed by a vendor advisory; check the vendor repository or official sources for updated releases containing the fix.