CVE-2024-26956

What it actually does

The flaw causes nilfs_get_block() to return success after nilfs_dat_translate() fails with -ENOENT due to DAT metadata corruption in btree or direct mappings; this leaves the buffer unmapped while callers like __block_write_begin_int() proceed to request I/O, triggering a BUG_ON(BH_Mapped) check in submit_bh_wbc().

Why it matters to the business

Systems using the nilfs2 filesystem on Linux kernels may experience unexpected kernel panics and crashes when metadata corruption is present, leading to downtime and potential data access loss until the system is recovered or updated.

How an attack unfolds

An attacker with the ability to corrupt nilfs2 DAT metadata can trigger inconsistent block lookup results; when subsequent write operations occur, the kernel hits the unmapped buffer condition and crashes. No remote unauthenticated exploitation path is described and the low EPSS indicates limited in-the-wild use.

How to fix it

Upgrade the Linux kernel to a version containing commit b67189690eb4b7ecc84ae16fa1e880e0123eaa35 or later stable releases that include the nilfs2 DAT corruption fix; rebuild and reboot affected systems.

How to confirm the fix worked

Verify the running kernel contains commit b67189690eb4b7ecc84ae16fa1e880e0123eaa35; attempt to reproduce the original syzbot reproducer on a test nilfs2 instance with induced DAT corruption and confirm no BUG_ON occurs.

Typical attack path

1. Obtain write access to a nilfs2 filesystem or the ability to induce metadata corruption
2. Corrupt DAT structures used by btree or direct block mappings
3. Perform file write operations that invoke nilfs_get_block() on affected blocks
4. Trigger the inconsistent success return and subsequent BUG_ON in submit_bh_wbc()

How to detect it

Review kernel logs for BUG_ON messages referencing submit_bh_wbc and BH_Mapped on nilfs2 filesystems; examine dmesg or syslog for nilfs2 bmap layer errors converting -EINVAL to -EIO after DAT lookup failures.

What your security team should do

• Prioritize patching all systems running nilfs2 filesystems to the fixed commit within standard change windows
• Monitor upstream stable kernel releases for backports of this fix
• Include nilfs2 metadata integrity checks in filesystem health monitoring