PT-2026-64580 · Linux · Linux
CVE-2026-64359
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: reject CLEAN SEGMENTS ioctl with out-of-range segment numbers
Syzbot reported a hung task in nilfs transaction begin() where multiple
tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds
waiting to acquire ns segctor sem for read:
INFO: task syz.0.17:5918 blocked for more than 143 seconds.
Call Trace:
schedule+0x164/0x360
rwsem down read slowpath+0x6d9/0x940
down read+0x99/0x2e0
nilfs transaction begin+0x364/0x710 fs/nilfs2/segment.c:221
nilfs setattr+0x124/0x2c0 fs/nilfs2/inode.c:921
notify change+0xc1a/0xf40
chmod common+0x273/0x4a0
do fchmodat+0x12d/0x230
The writer holding ns segctor sem was a concurrent
NILFS IOCTL CLEAN SEGMENTS caller, stuck inside printk while emitting
per-element warnings from nilfs sufile updatev():
nilfs msg+0x373/0x450 fs/nilfs2/super.c:78
nilfs sufile updatev+0x21c/0x6d0 fs/nilfs2/sufile.c:186
nilfs sufile freev fs/nilfs2/sufile.h:93 [inline]
nilfs free segments fs/nilfs2/segment.c:1140 [inline]
nilfs segctor collect blocks fs/nilfs2/segment.c:1261 [inline]
nilfs segctor do construct+0x1f55/0x76c0
nilfs clean segments+0x3bd/0xa50
nilfs ioctl clean segments fs/nilfs2/ioctl.c:922 [inline]
nilfs ioctl+0x261f/0x2780
The root cause is that user-supplied segment numbers are not validated
before nilfs clean segments() begins doing work; the range check on
each segnum is performed deep inside the call chain by
nilfs sufile updatev(), which emits a nilfs warn() per invalid entry
while still holding the segctor lock and the sufile mi sem. Under load
(repeated invocations across multiple mounts saturating the global
printk path), the cumulative printk latency keeps ns segctor sem held
long enough to trip the hung task watchdog, blocking concurrent
operations such as chmod() that need ns segctor sem for read.
Fix by validating the contents of kbufs[4] in nilfs clean segments()
immediately after acquiring ns segctor sem via nilfs transaction lock().
Holding ns segctor sem serializes the check against
nilfs ioctl resize(), which can modify ns nsegments, so the validation
uses a consistent value. Out-of-range segment numbers are rejected
with -EINVAL before any segment-cleaning work begins, so the bad
entries never reach the per-element diagnostic path inside
nilfs sufile updatev().
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux