SB20260425136 - NULL pointer dereference in Linux kernel nilfs2

Description

This security bulletin contains information about 1 vulnerability.

1) NULL pointer dereference (CVE-ID: CVE-2026-31577)

CWE-ID: CWE-476 - NULL Pointer Dereference

CVSSv4: CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to a NULL pointer dereference in nilfs_mdt_save_to_shadow_map() when handling NILFS_IOCTL_CLEAN_SEGMENTS immediately after mount before any btree operation has occurred on the DAT inode. A local user can invoke the ioctl in that state to cause a denial of service.

The issue occurs because the DAT inode's i_assoc_inode may remain uninitialized until a btree operation is performed.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/41de342278ae025c99cc8d33648773f05e306cf1
• https://git.kernel.org/stable/c/449ec5fc99f45974525ba9eea16b6670c45cd363
• https://git.kernel.org/stable/c/97fb7afec404912d967a7d4715f37742666b3084
• https://git.kernel.org/stable/c/c36e206f302f1ddefed92d09ecbba070e1ae079e