CVE-2026-64359 Overview
CVE-2026-64359 is a denial-of-service vulnerability in the Linux kernel's nilfs2 filesystem. The flaw resides in the NILFS_IOCTL_CLEAN_SEGMENTS ioctl handler, which fails to validate user-supplied segment numbers before beginning cleanup work. When invalid segment numbers are supplied, per-element warnings emitted by nilfs_sufile_updatev() accumulate printk latency while holding ns_segctor_sem. Concurrent filesystem operations such as chmod() block waiting on the same semaphore, tripping the hung-task watchdog after 143 seconds. Syzbot reported the issue on kernels running a mounted nilfs2 filesystem. The vulnerability has been resolved in mainline Linux via multiple backported stable-branch commits.
Critical Impact
A local user with access to a nilfs2 mount can trigger a hung-task condition, blocking concurrent filesystem operations and impacting system availability.
Affected Products
- Linux kernel with nilfs2 filesystem support enabled
- Systems mounting nilfs2 volumes accessible to local users
- Distribution kernels prior to the applicable stable backport commits
Discovery Timeline
- 2026-07-25 - CVE-2026-64359 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64359
Vulnerability Analysis
The vulnerability is a lock-contention denial of service triggered through the NILFS_IOCTL_CLEAN_SEGMENTS ioctl in fs/nilfs2/ioctl.c. The kernel accepts user-supplied segment numbers in kbufs[4] and passes them to nilfs_clean_segments() without range validation. Validation only occurs deep in the call chain inside nilfs_sufile_updatev(), which emits a nilfs_warn() diagnostic for every invalid entry.
Each warning goes through the global printk path while ns_segctor_sem and the sufile mi_sem remain held. When an attacker submits large arrays of out-of-range segment numbers, cumulative printk latency prevents timely release of ns_segctor_sem. Concurrent tasks calling nilfs_transaction_begin() for read, such as chmod() via nilfs_setattr(), block indefinitely and trip the hung_task watchdog.
Root Cause
The root cause is missing input validation in nilfs_ioctl_clean_segments(). Boundary checks against ns_nsegments occur only during downstream segment update processing, and the diagnostic path amplifies latency under load by serializing many printk() calls while critical filesystem semaphores are held.
Attack Vector
An attacker with permission to invoke ioctls on a mounted nilfs2 filesystem crafts a NILFS_IOCTL_CLEAN_SEGMENTS call containing many segment numbers greater than or equal to ns_nsegments. Repeated invocations across mounts saturate the printk path, holding ns_segctor_sem long enough to block all concurrent write-side filesystem operations and trigger hung-task warnings.
No synthetic exploitation code is provided. Refer to the upstream patches for the exact validation logic added to nilfs_clean_segments(). See Linux Kernel Commit 0789f0a and Linux Kernel Commit 3ed388ec for the authoritative fix.
Detection Methods for CVE-2026-64359
Indicators of Compromise
- Kernel log entries containing INFO: task ... blocked for more than 143 seconds referencing nilfs_transaction_begin in the call stack.
- High volume of nilfs_warn() messages originating from nilfs_sufile_updatev in dmesg or /var/log/messages.
- Unexplained stalls on nilfs2-mounted volumes during chmod, chown, or other attribute-changing operations.
Detection Strategies
- Monitor kernel ring buffer output for repeated nilfs2 warnings tied to segment updates within short time windows.
- Alert on hung_task watchdog events referencing rwsem_down_read_slowpath and nilfs_transaction_begin.
- Audit invocations of ioctl() with the NILFS_IOCTL_CLEAN_SEGMENTS command number from non-root or unexpected user contexts.
Monitoring Recommendations
- Ingest /dev/kmsg and syslog into a central logging pipeline and build queries for nilfs2 warning patterns.
- Track filesystem latency metrics on nilfs2 volumes and flag sustained multi-second write stalls.
- Correlate ioctl syscall telemetry with process ownership to identify unprivileged users repeatedly calling filesystem management ioctls.
How to Mitigate CVE-2026-64359
Immediate Actions Required
- Apply the vendor-supplied kernel update containing the upstream fix from the referenced stable commits.
- If nilfs2 is not required, unload the module with modprobe -r nilfs2 and blacklist it to remove the attack surface.
- Restrict mount and ioctl access on nilfs2 volumes to trusted administrative users only.
Patch Information
The fix validates the contents of kbufs[4] in nilfs_clean_segments() immediately after acquiring ns_segctor_sem via nilfs_transaction_lock(). Holding the semaphore serializes the check against nilfs_ioctl_resize(), ensuring ns_nsegments is stable during validation. Out-of-range segment numbers are rejected with -EINVAL before any cleanup work begins. Backports are available in Linux Kernel Commit 0789f0a, Linux Kernel Commit 0e7a690f, Linux Kernel Commit 223463c4, Linux Kernel Commit 286f77d0, Linux Kernel Commit 39607452, Linux Kernel Commit 3ed388ec, Linux Kernel Commit 876c98e0, and Linux Kernel Commit d26aef77.
Workarounds
- Prevent automatic loading of the nilfs2 module by adding install nilfs2 /bin/true to /etc/modprobe.d/ configuration.
- Ensure no user-writable nilfs2 volumes are mounted where local users can issue ioctls.
- Tighten dmesg_restrict and kptr_restrict sysctls to reduce diagnostic visibility while planning kernel updates.
# Disable nilfs2 module loading until patched kernel is deployed
echo 'install nilfs2 /bin/true' | sudo tee /etc/modprobe.d/disable-nilfs2.conf
sudo modprobe -r nilfs2 2>/dev/null || true
# Verify the module is not loaded
lsmod | grep nilfs2
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
