CVE-2026-80807 - Vulnerability Details

- nilfs2: reject invalid block index in GC ioctl

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject invalid block index in GC ioctl

Syzbot reported list corruption caused by a double list_add_tail() call on
bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers().

Analysis revealed that the root cause was the insertion of a page/folio
with a page index of ULONG_MAX into the page cache via the GC ioctl.
filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(),
repeatedly detects a dirty folio with a page index of ULONG_MAX due to
index wrap-around, leading to duplicate processing of dirty buffers.

As a preparatory step, the GC ioctl loads the page/folio of the block to
be moved during GC and inserts it into the page cache based on information
in the nilfs_vdesc structure passed as an argument. Normally, this does
not cause issues because the user-space GC library configures the
nilfs_vdesc structure properly. However, since there is no range check on
the parameters determining the page index, a request with artificially
crafted parameters -- such as those generated by Syzbot -- can result in a
page/folio being inserted with a page index of ULONG_MAX, triggering the
above problem.

This resolves the issue by checking the ranges of 'vd_offset' and
'vd_vblocknr' in the nilfs_vdesc structure that determine the page index,
thereby preventing the invalid page/folio insertions.

Published: 2026-09-04

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Impact

This vulnerability arises from an absent bounds check on the nilfs2 GC ioctl arguments, allowing a crafted request to insert a page with the maximum unsigned long index into the page cache. The resulting double list_add_tail on bh->b_assoc_buffers inside nilfs_lookup_dirty_data_buffers corrupts the kernel’s dirty buffer tracking list, potentially causing further kernel memory corruption and application crashes. The corruption enables an attacker to destabilize the system and potentially gain elevated privileges.

Affected Systems

All Linux kernels that build the nilfs2 file system are potentially affected. The description does not specify affected release versions, so any instance that includes nilfs2 without the range‑check patch may be vulnerable. It is inferred that any configuration exposing the nilfs2 GC ioctl is potentially vulnerable.

Risk and Exploitability

Exploitation requires a local user to invoke the nilfs2 GC ioctl with carefully crafted parameters. No remote code execution mechanism is reported, and the vulnerability does not require network access. The EPSS score is not available and the issue is not listed in the CISA KEV catalog. Because the flaw can corrupt kernel memory structures, the overall risk is significant for any system where the nilfs2 GC ioctl is accessible to untrusted users.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< 898404cdf882d7b54f1132f75570984ca3214796
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< ba8a8b563a28d358c45c62a306d421434a058648
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< 3bd064ccc70b85f9a3d53aece29dc8473be5a226
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< a5e776e2937581d67ec5b9b4d27b0f70d7baa6b1
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< 68aa9ab6f8f2895713aa6ddf781463ed8ea5ba44
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< e447f7edb99bd00cec63d6f3049e2e5074946f71
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< ec6ddf271dfa4c7e3147bc2c8b2bad4315f316a1
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< fbcfb75c20d71a5b542ad4ac3b79d10b997c8152
`7942b919f7321f95a777d396ff7894a7a83dc9b0`	affected	< a1735eae55448bc79c2da6593455791e886f6ed8

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`5.10.269`	unaffected	≤ 5.10.*
`5.15.220`	unaffected	≤ 5.15.*
`6.1.187`	unaffected	≤ 6.1.*
`6.6.156`	unaffected	≤ 6.6.*
`6.12.108`	unaffected	≤ 6.12.*
`6.18.47`	unaffected	≤ 6.18.*
`7.1.11`	unaffected	≤ 7.1.*
`7.2.1`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,898404cdf882d7b54f1132f75570984ca3214796)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,ba8a8b563a28d358c45c62a306d421434a058648)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,3bd064ccc70b85f9a3d53aece29dc8473be5a226)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,a5e776e2937581d67ec5b9b4d27b0f70d7baa6b1)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,68aa9ab6f8f2895713aa6ddf781463ed8ea5ba44)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,e447f7edb99bd00cec63d6f3049e2e5074946f71)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,ec6ddf271dfa4c7e3147bc2c8b2bad4315f316a1)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,fbcfb75c20d71a5b542ad4ac3b79d10b997c8152)`	affected	code_commit	—
`[7942b919f7321f95a777d396ff7894a7a83dc9b0,a1735eae55448bc79c2da6593455791e886f6ed8)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	generic	—
`[5.10.269,6.0.0)`	unaffected	semver	—
`[5.15.220,6.0.0)`	unaffected	semver	—
`[6.1.187,7.0.0)`	unaffected	semver	—
`[6.6.156,7.0.0)`	unaffected	semver	—
`[6.12.108,7.0.0)`	unaffected	semver	—
`[6.18.47,7.0.0)`	unaffected	semver	—
`[7.1.11,8.0.0)`	unaffected	semver	—
`[7.2.1,8.0.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the nilfs2 range‑check patch
Apply the kernel patch that enforces bounds validation on vd_offset and vd_vblocknr before inserting a page/folio into the page cache
Restrict access to the nilfs2 GC ioctl to a trusted privileged group or remove the capability from untrusted users
Monitor kernel logs for signs of repeated list_add_tail failures or page‑cache anomalies that may indicate exploitation attempts

Generated by OpenCVE AI on September 4, 2026 at 22:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/3bd064ccc70b85f9a3d53aece29dc8473be5a226
https://git.kernel.org/stable/c/68aa9ab6f8f2895713aa6ddf781463ed8ea5ba44
https://git.kernel.org/stable/c/898404cdf882d7b54f1132f75570984ca3214796
https://git.kernel.org/stable/c/a1735eae55448bc79c2da6593455791e886f6ed8
https://git.kernel.org/stable/c/a5e776e2937581d67ec5b9b4d27b0f70d7baa6b1
https://git.kernel.org/stable/c/ba8a8b563a28d358c45c62a306d421434a058648
https://git.kernel.org/stable/c/e447f7edb99bd00cec63d6f3049e2e5074946f71
https://git.kernel.org/stable/c/ec6ddf271dfa4c7e3147bc2c8b2bad4315f316a1
https://git.kernel.org/stable/c/fbcfb75c20d71a5b542ad4ac3b79d10b997c8152

History

Fri, 04 Sep 2026 22:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-20

Fri, 04 Sep 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: nilfs2: reject invalid block index in GC ioctl Syzbot reported list corruption caused by a double list_add_tail() call on bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers(). Analysis revealed that the root cause was the insertion of a page/folio with a page index of ULONG_MAX into the page cache via the GC ioctl. filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(), repeatedly detects a dirty folio with a page index of ULONG_MAX due to index wrap-around, leading to duplicate processing of dirty buffers. As a preparatory step, the GC ioctl loads the page/folio of the block to be moved during GC and inserts it into the page cache based on information in the nilfs_vdesc structure passed as an argument. Normally, this does not cause issues because the user-space GC library configures the nilfs_vdesc structure properly. However, since there is no range check on the parameters determining the page index, a request with artificially crafted parameters -- such as those generated by Syzbot -- can result in a page/folio being inserted with a page index of ULONG_MAX, triggering the above problem. This resolves the issue by checking the ranges of 'vd_offset' and 'vd_vblocknr' in the nilfs_vdesc structure that determine the page index, thereby preventing the invalid page/folio insertions.
Title		nilfs2: reject invalid block index in GC ioctl
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/3bd064ccc70b85f9a3d53aece29dc8473be5a226 https://git.kernel.org/stable/c/68aa9ab6f8f2895713aa6ddf781463ed8ea5ba44 https://git.kernel.org/stable/c/898404cdf882d7b54f1132f75570984ca3214796 https://git.kernel.org/stable/c/a1735eae55448bc79c2da6593455791e886f6ed8 https://git.kernel.org/stable/c/a5e776e2937581d67ec5b9b4d27b0f70d7baa6b1 https://git.kernel.org/stable/c/ba8a8b563a28d358c45c62a306d421434a058648 https://git.kernel.org/stable/c/e447f7edb99bd00cec63d6f3049e2e5074946f71 https://git.kernel.org/stable/c/ec6ddf271dfa4c7e3147bc2c8b2bad4315f316a1 https://git.kernel.org/stable/c/fbcfb75c20d71a5b542ad4ac3b79d10b997c8152

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T15:13:23.605Z

Updated: 2026-09-04T15:13:23.605Z

Reserved: 2026-08-26T14:34:25.794Z

Link: CVE-2026-80807

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-04T16:18:07.810

Modified: 2026-09-04T16:18:07.810

Link: CVE-2026-80807

Redhat

No data.

OpenCVE Enrichment

Updated: 2026-09-04T22:00:06Z

Weaknesses

CWE-20
Improper Input Validation

Impact

Affected Systems

Risk and Exploitability

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object