CVE-2024-26981

What it actually does

Out-of-bounds read in nilfs_set_de_type when (mode & S_IFMT) >> S_SHIFT equals array size, caused by nilfs_type_by_mode sized to S_IFMT >> S_SHIFT allowing index one past end on exact S_IFMT match.

Why it matters to the business

Local attackers on systems using the nilfs2 filesystem can trigger kernel memory access violations leading to crashes, information leaks, or potential code execution, affecting stability and security of Linux-based storage or embedded deployments.

How an attack unfolds

An attacker with local access creates or manipulates inodes and directory entries on a nilfs2 volume so that nilfs_set_de_type is called with a mode value satisfying mode & S_IFMT == S_IFMT; the resulting out-of-bounds array access is used to read adjacent kernel memory for further exploitation such as privilege escalation.

How to fix it

Apply the upstream fix present in commit 054f29e9ca05be3906544c5f2a2c7321c30a4243 or upgrade to a Linux kernel release containing that change; rebuild and reboot with the patched kernel before allowing nilfs2 mounts.

How to confirm the fix worked

Confirm the running kernel contains commit 054f29e9ca05be3906544c5f2a2c7321c30a4243, inspect fs/nilfs2/dir.c to verify nilfs_type_by_mode is sized one element larger, and test directory operations with S_IFMT modes under a debug kernel.

Typical attack path

1. Obtain local user access on target Linux system
2. Create or mount a nilfs2 filesystem containing crafted directory entries
3. Perform file operations that invoke nilfs_set_de_type with S_IFMT mode value
4. Leverage resulting OOB read for kernel memory disclosure or corruption

How to detect it

Search kernel logs and dmesg for oops or panic messages referencing nilfs_set_de_type or nilfs_type_by_mode; monitor audit logs for unusual nilfs2 mount and directory operations from unprivileged users.

• nilfs_set_de_type
• nilfs_type_by_mode
• OOB access in fs/nilfs2/dir.c

What your security team should do

• Prioritize kernel upgrade to the fixed commit across all systems using nilfs2
• Temporarily disable nilfs2 mounts via module blacklist until patched kernels are deployed
• Include nilfs2-related kernel oops logs in routine security monitoring