CVE-2026-53130

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE),

but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset(). Since s_sys_blocksize is u32,

a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes

an unsigned underflow there, wrapping to a value near 2^32. That drives

a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel

memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound

check in omfs_fill_super(), so that malformed images are rejected during

superblock validation before any filesystem data is processed.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References