Cloudanix VulnDB

CVE-2026-90420

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in Linux file system cleanup code can make parts of the system freeze indefinitely after certain disk errors, requiring a restart to recover.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

The nilfs_clean_segments ioctl enters an infinite loop when nilfs_segctor_construct repeatedly returns -EROFS, preventing the transaction begin from completing and hanging the task.

Why it matters to the business

Systems using the nilfs2 filesystem can experience unrecoverable task hangs that require manual intervention or reboot, disrupting storage operations and availability.

How an attack unfolds

An attacker with access to the cleaner ioctl triggers repeated -EROFS returns by forcing a read-only remount after an I/O error, causing the loop to spin indefinitely without aborting on the terminal error.

How to fix it

Update the Linux kernel to a version containing the fix that breaks out of the loop on -EROFS in nilfs_clean_segments, matching the handling already present in nilfs_segctor_write_out.

How to confirm the fix worked

Confirm the kernel source contains the break on -EROFS return from nilfs_segctor_construct inside nilfs_clean_segments; test by inducing a read-only remount and invoking the cleaner ioctl to verify the loop terminates.

Typical attack path

  1. Gain local access or trigger I/O error conditions on a nilfs2 volume
  2. Remount the device read-only
  3. Invoke the nilfs_clean_segments ioctl
  4. nilfs_segctor_construct returns -EROFS repeatedly
  5. Thread enters infinite sleep-log loop in nilfs_clean_segments

How to detect it

Review kernel logs for repeated nilfs error messages containing -EROFS from nilfs_clean_segments or nilfs_segctor_construct; inspect for tasks stuck in nilfs_transaction_begin or D-state nilfs threads.

  • nilfs_clean_segments: nilfs_segctor_construct returned
  • nilfs_transaction_begin
  • -EROFS
  • hung task

What your security team should do

  • Apply the upstream nilfs2 fix immediately on any systems running affected kernels
  • Monitor for hung tasks referencing nilfs_transaction_begin or nilfs_clean_segments
  • Restrict unprivileged access to nilfs2 volumes and the cleaner ioctl until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_clean_segments() syzbot reported a hung task in nilfs_transaction_begin(). This occurs because the cleaner ioctl falls into an infinite loop if nilfs_segctor_construct() repeatedly returns -EROFS (e.g. the device is remounted as read-only after an I/O error). Currently in nilfs_clean_segments(), if err is non-zero, it logs the error and sleeps but doesn't abort when it encounters a terminal error like -EROFS. This causes the thread to loop forever. Fix this by breaking out of the loop if nilfs_segctor_construct() returns -EROFS. This matches the behaviour in nilfs_segctor_write_out(), which also handles -EROFS.

Affected packages

Ecosystem Package Introduced Fixed