CVE-2026-53320 Overview
CVE-2026-53320 is a Linux kernel vulnerability in the nilfs2 filesystem. The flaw resides in the nilfs_ioctl_mark_blocks_dirty() function, which uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. A corrupted ioctl request with bd_oblocknr set to 0 bypasses the dead block check, causing nilfs_bmap_mark() to operate on a non-existent block. This triggers a WARN_ON(ret == -ENOENT) inside nilfs_btree_do_lookup(). The upstream fix rejects ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration.
Critical Impact
Local attackers submitting crafted nilfs2 garbage collection ioctl requests can trigger kernel warnings and disrupt filesystem integrity checks on affected systems.
Affected Products
- Linux kernel builds that include the nilfs2 filesystem driver
- Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
- Systems where the nilfs2 module is loaded and reachable via ioctl by local users
Discovery Timeline
- 2026-06-26 - CVE-2026-53320 published to NVD
- 2026-06-30 - Last updated in NVD database
Technical Details for CVE-2026-53320
Vulnerability Analysis
The nilfs2 filesystem implements a log-structured design and exposes garbage collection (GC) primitives through ioctl interfaces. The nilfs_ioctl_mark_blocks_dirty() routine iterates over caller-supplied block descriptors and marks candidate blocks dirty so they can be relocated during GC. To skip blocks that have been overwritten since the caller collected them, the function compares the original block number bd_oblocknr against the current lookup result bd_blocknr. When these values differ, the block is treated as dead and skipped.
The issue arises because bd_oblocknr is not validated. Block 0 stores the primary superblock and cannot be a legitimate GC target. When a caller submits bd_oblocknr = 0 and the block lookup returns -ENOENT, the code path sets bd_blocknr to 0, causing the comparison to falsely match. The dead-block skip is bypassed and nilfs_bmap_mark() is called on a non-existent block, propagating -ENOENT through nilfs_btree_do_lookup() and firing the WARN_ON(ret == -ENOENT) assertion [CWE-20].
Root Cause
The root cause is missing input validation on the bd_oblocknr field of ioctl-supplied block descriptors. The function trusted user-controlled input and treated a zero value as a valid original block number.
Attack Vector
A local user with permission to invoke nilfs2 GC ioctls can supply a crafted nilfs_bdesc structure containing bd_oblocknr = 0. Processing the request triggers the kernel warning and destabilizes filesystem bookkeeping.
No verified proof-of-concept code has been published. See the upstream commits referenced under Kernel Git Commit 1 and Kernel Git Commit 8 for the exact fix diff.
Detection Methods for CVE-2026-53320
Indicators of Compromise
- Kernel log entries containing WARN_ON traces originating in nilfs_btree_do_lookup() or nilfs_ioctl_mark_blocks_dirty().
- Unexpected -ENOENT returns from nilfs2 ioctl syscalls in audit logs.
- Unprivileged processes issuing nilfs2 GC-related ioctls on production hosts that do not typically mount nilfs2.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for stack traces referencing nilfs2 functions on hosts running vulnerable kernels.
- Enable Linux Audit rules on the ioctl syscall for file descriptors bound to nilfs2 mount points and flag anomalous callers.
- Correlate kernel warnings with the invoking process and user identity to identify potentially malicious local activity.
Monitoring Recommendations
- Track kernel version inventory to identify hosts running kernels prior to the fix commits listed on kernel.org.
- Alert on module load events for nilfs2.ko on systems that do not require the filesystem.
- Aggregate kernel crash and warning telemetry centrally so repeated WARN_ON events can be triaged quickly.
How to Mitigate CVE-2026-53320
Immediate Actions Required
- Update to a kernel that includes the nilfs2 fix commits published on kernel.org for this CVE.
- If patching is not immediately possible, unload the nilfs2 module on hosts that do not use it: modprobe -r nilfs2.
- Restrict local shell access on multi-tenant systems until the patched kernel is deployed.
Patch Information
The fix rejects bd_oblocknr == 0 at the start of each iteration in nilfs_ioctl_mark_blocks_dirty(). Patched builds are tracked across stable branches through the following references: Kernel Git Commit 1, Kernel Git Commit 2, Kernel Git Commit 3, Kernel Git Commit 4, Kernel Git Commit 5, Kernel Git Commit 6, Kernel Git Commit 7, and Kernel Git Commit 8.
Workarounds
- Blacklist the nilfs2 module on servers that do not mount nilfs2 volumes to eliminate the attack surface.
- Restrict access to nilfs2 mount points and GC ioctls through Linux Security Modules such as SELinux or AppArmor.
- Enforce least privilege on interactive users so untrusted accounts cannot invoke filesystem GC ioctls.
# Blacklist the nilfs2 module until patched kernels are deployed
echo 'blacklist nilfs2' | sudo tee /etc/modprobe.d/blacklist-nilfs2.conf
sudo modprobe -r nilfs2
# Verify the module is no longer loaded
lsmod | grep nilfs2 || echo 'nilfs2 not loaded'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
