The Linux kernel nilfs2 filesystem had a vulnerability where the CLEAN_SEGMENTS ioctl did not validate user-supplied segment numbers before processing. This caused tasks performing chmod operations on a nilfs2 mount to block for over 143 seconds waiting on the ns_segctor_sem semaphore. The root cause was delayed range checking of segment numbers deep in the call chain, which triggered numerous printk warnings while holding locks, leading to hung tasks. The fix adds validation of segment numbers immediately after acquiring the ns_segctor_sem lock, rejecting out-of-range values with -EINVAL before any segment-cleaning work begins, preventing the lock contention and hung tasks.

The vulnerability causes kernel tasks interacting with nilfs2 mounts to hang for extended periods due to lock contention triggered by invalid segment numbers passed to the CLEAN_SEGMENTS ioctl. This can degrade system responsiveness and block legitimate filesystem operations such as chmod. There is no indication of privilege escalation or arbitrary code execution. No known exploits in the wild have been reported.

A fix is available that validates segment numbers early in the CLEAN_SEGMENTS ioctl handler, rejecting out-of-range values before processing. Users should apply the official Linux kernel patch that implements this validation. Since this is a kernel-level fix, upgrading to a kernel version containing this patch is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor advisory or Linux kernel mailing lists for the exact fixed version and apply updates accordingly.