Skip to main content

Linux Kernel CVE-2026-53320

| EUVDEUVD-2026-39855 MEDIUM
2026-06-26 Linux GHSA-r88h-63mh-cc6h
Authentication Bypass Linux Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local ioctl invocation with low-privilege user access required; pure availability impact via kernel WARN_ON with no confidentiality or integrity consequences.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 06, 2026 - 20:47 vuln.today
CVSS changed
Jul 06, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch available
Jun 26, 2026 - 21:02 EUVD
CVE Published
Jun 26, 2026 - 19:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jun 26, 2026 - 19:41 nvd
MEDIUM 5.5

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject zero bd_oblocknr in nilfs_ioctl_mark_blocks_dirty()

nilfs_ioctl_mark_blocks_dirty() uses bd_oblocknr to detect dead blocks by comparing it with the current block number bd_blocknr. If they differ, the block is considered dead and skipped.

However, bd_oblocknr should never be 0 since block 0 typically stores the primary superblock and is never a valid GC target block. A corrupted ioctl request with bd_oblocknr set to 0 causes the comparison to incorrectly match when the lookup returns -ENOENT and sets bd_blocknr to 0, bypassing the dead block check and calling nilfs_bmap_mark() on a non-existent block. This causes nilfs_btree_do_lookup() to return -ENOENT, triggering the WARN_ON(ret == -ENOENT).

Fix this by rejecting ioctl requests with bd_oblocknr set to 0 at the beginning of each iteration.

[ryusuke: slightly modified the commit message and comments for accuracy]

AnalysisAI

Improper input validation in the Linux kernel's nilfs2 filesystem driver allows a local low-privileged user to trigger a kernel WARN_ON and cause a denial of service by submitting a crafted ioctl request with bd_oblocknr set to zero. The zero value collides with the -ENOENT sentinel path in nilfs_ioctl_mark_blocks_dirty(), bypassing the dead block detection logic and passing an invalid block reference into nilfs_bmap_mark(). No active exploitation has been identified (EPSS 0.17%, not in CISA KEV), and patches are available across all actively maintained Linux stable branches.

Technical ContextAI

The vulnerability resides in the nilfs2 (New Implementation of a Log-structured File System) driver, specifically the nilfs_ioctl_mark_blocks_dirty() function, which is invoked via ioctl to mark garbage collection (GC) target blocks as dirty. The function uses the bd_oblocknr field from the user-supplied ioctl struct as a sentinel: if bd_oblocknr differs from bd_blocknr after a block lookup, the block is treated as dead and skipped. Block 0 in nilfs2 holds the primary superblock and is architecturally never a valid GC target. When a block lookup fails with -ENOENT, the kernel internally sets bd_blocknr to 0. A user-supplied bd_oblocknr of 0 therefore spuriously matches this sentinel value, bypassing the dead block check entirely. The function then proceeds to call nilfs_bmap_mark() on the non-existent block, driving execution into nilfs_btree_do_lookup(), which returns -ENOENT and fires WARN_ON(ret == -ENOENT). The root cause is a missing zero-value rejection guard at the start of each iteration in the ioctl handler. No CWE was formally assigned, but this maps to CWE-20 (Improper Input Validation). Affected products per CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* from kernel 2.6.30 onward.

RemediationAI

Update to the nearest patched stable kernel release: 5.10.258 or later for the 5.10.x series, 5.15.209 or later for 5.15.x, 6.1.175 or later for 6.1.x, 6.6.141 or later for 6.6.x, 6.12.91 or later for 6.12.x, 6.18.33 or later for 6.18.x, 7.0.10 or later for 7.0.x, and 7.1 or later for the mainline series. Upstream fix commits are available at https://git.kernel.org/stable/c/e0a0c4903cbba351f0f5b5d104960d3a5b23202f and sibling commits listed in EUVD-2026-39855. As a compensating control on systems where nilfs2 is not required, add the line install nilfs2 /bin/false to /etc/modprobe.d/ to prevent module loading - this eliminates the attack surface entirely with no functional impact on systems not using nilfs2. Restricting ioctl access to privileged users only via filesystem permissions or LSM (SELinux/AppArmor) policy can also reduce risk where module blacklisting is impractical.

Same technique Authentication Bypass

View all
CVE-2023-22515 CRITICAL POC
9.8
CVE-2012-4681 CRITICAL POC
9.8
CVE-2013-2465 CRITICAL POC
9.8
CVE-2011-3544 CRITICAL POC
9.8
CVE-2022-40684 CRITICAL POC
9.8
CVE-2025-61882 CRITICAL POC
9.8
CVE-2024-0012 CRITICAL POC
9.3
CVE-2023-46805 HIGH POC
8.2

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53320 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy