In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers Syzbot… (CVE-2026-64359)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 1% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:HWhat to do
AI-suggested
A fix is available that validates segment numbers early in the CLEAN_SEGMENTS ioctl handler to reject out-of-range values before any segment-cleaning work or logging occurs. Users should apply the updated Linux kernel version containing this patch to prevent denial of service conditions. No additional mitigation is required beyond applying the official fix.
Description
A vulnerability in the Linux kernel's NILFS2 filesystem was resolved that involved improper validation of segment numbers passed to the CLEAN_SEGMENTS ioctl. This flaw could cause tasks performing chmod operations on a NILFS2 mount to hang for extended periods due to a semaphore being held during excessive printk logging. The issue was fixed by validating segment numbers early to reject out-of-range values before any segment-cleaning work begins.
Impact
The vulnerability can cause denial of service by blocking tasks that require the ns_segctor_sem semaphore, leading to hung tasks for over 143 seconds as observed. This impacts availability but does not affect confidentiality or integrity. The CVSS score is 5.5 (medium severity) with an impact primarily on availability.
Summary
The vulnerability (CVE-2026-64359) in the Linux kernel's NILFS2 filesystem involved the CLEAN_SEGMENTS ioctl accepting user-supplied segment numbers without proper validation before processing. This led to a situation where invalid segment numbers caused repeated warnings via printk while holding a semaphore (ns_segctor_sem), resulting in long blocking times for other tasks such as chmod operations on NILFS2 mounts. The root cause was that the range check was deferred too deep in the call chain, causing the semaphore to be held during expensive logging. The fix introduced validation of segment numbers immediately after acquiring the semaphore, rejecting invalid inputs with -EINVAL before any segment cleaning or logging occurs.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64359 (opens in a new tab)
- git.kernel.org/stable/c/0789f0a6710713254a08f3a7d2ecbb6d1cbcf0aa (opens in a new tab)
- git.kernel.org/stable/c/0e7a690fe435f8d5ea3feb7c1d8d73ba7e8b8aa9 (opens in a new tab)
- git.kernel.org/stable/c/223463c488b0554212a94de971ea538eb2805fc7 (opens in a new tab)
- git.kernel.org/stable/c/286f77d002a337735c0846d7480a82d9cda2aa31 (opens in a new tab)
- git.kernel.org/stable/c/39607452b1400c7bf748f15122df4d058b768c5b (opens in a new tab)
- git.kernel.org/stable/c/3ed388ec3b8922383d1e2d4432d7bd4cbbf8364e (opens in a new tab)
- git.kernel.org/stable/c/876c98e0fc65f071680c03c2e2ee3ef7ff9ca078 (opens in a new tab)
- git.kernel.org/stable/c/d26aef771b4f6923da9f89d6d5b70d8def5853de (opens in a new tab)