CVE-2026-53130: Linux Kernel OMFS Buffer Overflow Flaw

CVE-2026-53130 Overview

CVE-2026-53130 is a Linux kernel vulnerability in the OMFS (Optimized MPEG Filesystem) implementation. The flaw resides in omfs_fill_super(), which validates the s_sys_blocksize field against an upper bound but fails to enforce a lower bound. A crafted filesystem image with s_sys_blocksize smaller than OMFS_DIR_START (0x1b8 = 440) triggers an unsigned integer underflow in omfs_make_empty(). The resulting value wraps near 2^32, driving a roughly 4 GiB memset() that overwrites kernel memory well beyond the backing block buffer. The fix adds the missing lower-bound check during superblock validation.

Critical Impact
A crafted OMFS image triggers an unsigned underflow leading to a ~4 GiB out-of-bounds memset() that corrupts kernel memory, enabling denial of service or potential privilege escalation.

Affected Products

Linux kernel versions containing the unpatched fs/omfs superblock validation logic
Distributions shipping the OMFS filesystem driver as a loadable module
Systems permitting mounting of untrusted filesystem images by unprivileged users or automounters

Discovery Timeline

2026-06-24 - CVE-2026-53130 published to NVD
2026-06-24 - Last updated in NVD database

Technical Details for CVE-2026-53130

Vulnerability Analysis

The vulnerability is an integer underflow [CWE-191] in the Linux kernel OMFS filesystem driver. omfs_fill_super() validates the on-disk s_sys_blocksize against PAGE_SIZE but does not verify the field is at least OMFS_DIR_START (440 bytes). Because s_sys_blocksize is a u32, the expression sbi->s_sys_blocksize - OMFS_DIR_START underflows when the attacker-controlled value is smaller than 440. The wrapped result, approximately 2^32, is then passed as the length argument to memset() operating on bh->b_data + OMFS_DIR_START. The kernel writes roughly 4 GiB of zero bytes past the buffer boundary, corrupting arbitrary adjacent kernel memory.

Root Cause

The root cause is missing lower-bound input validation on a length-derived field read directly from untrusted filesystem metadata. The check s_sys_blocksize > PAGE_SIZE rejects oversized values but allows any value below OMFS_DIR_START, including zero. Subsequent arithmetic performed on this unvalidated u32 produces a wrapped length that is treated as a legitimate buffer size.

Attack Vector

Exploitation requires the ability to mount a crafted OMFS filesystem image. Attack scenarios include systems that auto-mount removable media, container environments that permit untrusted block devices, and platforms exposing user-mountable filesystems. After triggering the underflow, the resulting wide-ranging memset() overwrites kernel structures beyond the block buffer, typically leading to immediate kernel panic and denial of service. Depending on heap layout, controlled corruption could escalate to privilege escalation.

No public proof-of-concept has been published. Technical detail is available in the upstream commits referenced in the Linux Kernel stable commit history.

Detection Methods for CVE-2026-53130

Indicators of Compromise

Kernel oops or panic messages referencing omfs_fill_super or omfs_make_empty in dmesg or journal logs
Unexpected mount attempts of OMFS images on systems that do not normally use the filesystem
Loading of the omfs kernel module on hosts where it is not operationally required

Detection Strategies

Audit kernel module load events for the omfs driver using auditd or equivalent telemetry
Monitor mount syscalls referencing -t omfs or block devices identified as OMFS by blkid
Correlate kernel crash signatures involving large memset operations in filesystem context with recent mount activity

Monitoring Recommendations

Enable kernel lockdown and KASAN on test systems to surface out-of-bounds writes during validation
Forward kernel logs to a centralized data lake to retain crash traces and mount events for forensic review
Track removable media insertion and automounter activity on endpoints that handle untrusted storage

How to Mitigate CVE-2026-53130

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the NVD entry as soon as your distribution ships them
Blacklist the omfs kernel module on hosts that do not require it to remove the attack surface entirely
Restrict mounting of untrusted filesystem images to privileged users and disable user-space automounting of removable media where feasible

Patch Information

The fix adds the missing lower-bound check for s_sys_blocksize alongside the existing upper-bound check in omfs_fill_super(), rejecting malformed images during superblock validation before any filesystem data is processed. Patches are available in the upstream stable tree, including commits 0621c38, 131ea3e, 5822a05, 6561afc, 754ff1b, 79f84af, 817f16e, and fbc72f5.

Workarounds

Add omfs to the kernel module blacklist to prevent on-demand autoloading when an OMFS image is encountered
Disable automounting of removable storage in desktop session managers and udev rules
Constrain container and virtualization workloads from passing arbitrary block devices to the host kernel

bash

# Blacklist the omfs module to disable autoload
echo 'blacklist omfs' | sudo tee /etc/modprobe.d/blacklist-omfs.conf
echo 'install omfs /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-omfs.conf
sudo depmod -a

# Verify the module is not currently loaded
lsmod | grep omfs