Cloudanix VulnDB

CVE-2026-90419

High · 7.1

CVSS

7.1

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in how the Linux kernel reads certain filesystem structures could let an attacker who supplies a specially made disk image read parts of the computer's memory or crash the system.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Low
Impact
Data Exposure
Component
OS kernel
Class
Information Disclosure
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Out-of-bounds read in nilfs2 super-root inode parsing when a malicious filesystem image supplies an inode metadata size that exceeds the block size, allowing nilfs_read_inode_common to access memory beyond the super-root block.

Why it matters to the business

A local user or process that mounts an untrusted filesystem image can trigger kernel memory disclosure or a crash, potentially exposing sensitive data or causing denial of service on systems using the nilfs2 filesystem.

How an attack unfolds

An attacker prepares a malformed nilfs2 filesystem image containing a super-root inode whose on-disk size is set larger than the filesystem block size. When the victim mounts the image, the kernel trusts the size field and passes it to nilfs_read_inode_common, which then reads past the end of the allocated block, disclosing kernel memory or triggering a fault.

How to fix it

Update the Linux kernel to a version that includes the nilfs2 super-root inode size validation fix. Rebuild and reboot with the patched kernel; avoid mounting untrusted nilfs2 images until updated.

How to confirm the fix worked

Confirm the kernel source contains the commit that rejects super-root inode sizes exceeding block size before calling nilfs_read_inode_common; test by attempting to mount a crafted image and verifying the mount is rejected or succeeds without OOB access.

Typical attack path

  1. Craft a nilfs2 filesystem image with an oversized super-root inode metadata size
  2. Place the image on media or a location accessible to the target system
  3. Induce or wait for the target to mount the image (via mount command, automounter, or application)
  4. Kernel performs super-root block parsing and executes the out-of-bounds read

How to detect it

Monitor kernel logs for nilfs2 error messages during mount operations on untrusted media; inspect audit logs for mount syscalls targeting nilfs2 volumes from unexpected sources.

What your security team should do

  • Prioritize kernel updates on any system that may mount nilfs2 volumes
  • Disable nilfs2 module loading via modprobe blacklist if the filesystem is not required
  • Enforce policies that prevent unprivileged users from mounting arbitrary filesystem images

The record

In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-root inode metadata size is trusted before nilfs_read_inode_common(). Reject super-root inode sizes whose computed on-disk footprint exceeds the filesystem block size. This prevents malformed filesystem images from making nilfs_read_inode_common() read past the end of the super-root block. [ryusuke: clarify the commit title]

Affected packages

Ecosystem Package Introduced Fixed