CVE-2026-53320

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks

by comparing it with the current block number bd_blocknr. If they differ,

the block is considered dead and skipped.

However, bd_oblocknr should never be 0 since block 0 typically stores the

primary superblock and is never a valid GC target block. A corrupted ioctl

request with bd_oblocknr set to 0 causes the comparison to incorrectly

match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing

the dead block check and calling nilfs_bmap_mark() on a non-existent

block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering

the WARN_ON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the

beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References