CVE-2024-26697

What it actually does

Incorrect byte offset calculation in nilfs_recovery_copy_block() during dsync block recovery corrupts file page cache contents and leaks uninitialized memory when block size is smaller than page size on nilfs2 filesystems.

Why it matters to the business

Systems relying on nilfs2 for data integrity after unclean shutdowns risk silent file corruption and potential information disclosure, increasing operational overhead for data validation and recovery on affected Linux deployments with non-default block sizes.

How an attack unfolds

An attacker triggers repeated unclean shutdowns followed by filesystem mounts to invoke nilfs_recovery_dsync_blocks(), exploiting the flawed offset math to corrupt targeted files or leak kernel memory bytes into user-accessible pages during recovery.

How to fix it

Upgrade Linux kernel to commit 5278c3eb6bf5896417572b52adb6be9d26e92f65 or later; rebuild and deploy updated kernel packages across all affected distributions using nilfs2.

How to confirm the fix worked

Verify kernel source contains the corrected offset calculation in nilfs_recovery_copy_block(); test recovery scenarios with block size < page size and confirm absence of corruption or uninitialized data leakage post-mount.

Typical attack path

1. Force or wait for unclean shutdown with pending dsync writes on nilfs2 volume
2. Trigger mount operation that activates nilfs_recovery_dsync_blocks()
3. Observe or leverage resulting page cache corruption and memory disclosure

How to detect it

Review kernel logs for nilfs2 recovery messages during mount after unclean shutdowns; monitor for unexpected file content changes or memory patterns in recovered blocks; correlate with system crash timestamps.

What your security team should do

• Immediately audit all Linux systems for nilfs2 usage and schedule kernel upgrades to the fixed commit
• Implement filesystem integrity checks and monitoring for post-crash recovery events
• Disable nilfs2 on high-integrity workloads until patches are applied if block size configuration cannot be verified