CVE-2024-26955

What it actually does

nilfs_get_block() can return success after failing to find or insert a block due to an inconsistent state or race, causing __block_write_begin_int() to request I/O on an unmapped buffer and trigger BUG_ON(!buffer_mapped) inside submit_bh_wbc().

Why it matters to the business

Systems using the nilfs2 filesystem may experience unexpected kernel crashes or panics during write operations, leading to downtime and potential data corruption on affected Linux installations.

How an attack unfolds

An attacker with local access triggers concurrent block allocation and write operations on a nilfs2 filesystem, causing the race in nilfs_get_block() that leaves a buffer unmapped; subsequent write submission then hits the kernel BUG.

How to fix it

Update the Linux kernel to a version containing commit 91e4c4595fae5e87069e44687ae879091783c183 or later; rebuild and reboot with the patched kernel. Disable nilfs2 if patching is not feasible.

How to confirm the fix worked

Verify the running kernel contains commit 91e4c4595fae5e87069e44687ae879091783c183 via git log or uname; attempt to reproduce the original race condition under load and confirm absence of BUG_ON.

Typical attack path

1. Obtain local unprivileged access on a Linux system using nilfs2
2. Mount or access a nilfs2 volume
3. Perform concurrent file write and block allocation operations to trigger the race
4. Cause __block_write_begin to request I/O on an unmapped buffer
5. Trigger BUG_ON failure in submit_bh_wbc() resulting in kernel panic

How to detect it

Search kernel logs and dmesg for nilfs2, submit_bh_wbc, BH_Mapped, or BUG_ON messages; correlate with file write activity on nilfs2 mounts around the time of any kernel oops or panic.

• BUG_ON(!buffer_mapped(bh))
• submit_bh_wbc
• nilfs_get_block
• nilfs2: inconsistent get_block result

What your security team should do

• Prioritize patching all systems using nilfs2 within standard change windows
• Monitor kernel logs for nilfs2-related BUG_ON or submit_bh_wbc failures until patched
• Consider disabling nilfs2 on high-availability systems if upgrade timeline is extended
• Review filesystem usage inventory to identify remaining nilfs2 deployments