Cloudanix VulnDB

CVE-2026-90418

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A problem in the Linux kernel's handling of a specific file system can cause computers to crash unexpectedly during certain operations.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

The flaw triggers a kernel BUG in nilfs_copy_dirty_pages() when a dirty folio/page unexpectedly clears its dirty flag due to asynchronous behavior after nilfs2 detects metadata corruption and switches to read-only mode; resolved by returning -EROFS in read-only state and emitting a single warning otherwise.

Why it matters to the business

Causes unexpected kernel crashes and system instability on Linux hosts using the nilfs2 filesystem, leading to downtime and potential data access loss until reboot or patch application.

How an attack unfolds

An attacker performs filesystem operations that induce metadata corruption in nilfs2, forcing a read-only transition; subsequent page-cache operations then hit the dirty-state mismatch in nilfs_copy_dirty_pages, resulting in a BUG and denial of service.

How to fix it

Update the Linux kernel to a version containing the nilfs2 fix that returns -EROFS on read-only transition and replaces the BUG with a one-time warning; rebuild and reboot with the patched kernel.

How to confirm the fix worked

Confirm the running kernel contains the nilfs2 dirty-folio handling change; reproduce metadata-corruption scenarios in a test environment and verify no BUG occurs and -EROFS is returned cleanly.

Typical attack path

  1. Perform write or metadata operations on a nilfs2 volume to trigger corruption detection
  2. Force the filesystem into read-only mode
  3. Invoke nilfs_copy_dirty_pages via normal I/O or sync paths
  4. Exploit the race that clears the dirty flag asynchronously to hit the BUG

How to detect it

Search kernel logs and dmesg for BUG messages referencing nilfs_copy_dirty_pages or nilfs2 dirty-state mismatches; correlate with nilfs2 read-only mode transitions.

What your security team should do

  • Prioritize kernel updates on all systems mounting nilfs2 volumes
  • Add kernel BUG and nilfs2 read-only transition events to monitoring alerts
  • Test nilfs2 workloads under simulated corruption to validate patch behavior
  • Consider disabling nilfs2 or migrating critical workloads if patches cannot be applied promptly

The record

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status. This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode. Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

Affected packages

Ecosystem Package Introduced Fixed