CVE-2026-31577

Summary

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC.

If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault.

Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.

Affected Software

VendorProductVersion RangeStatus
LinuxLinuxd626fcdabea2258be395a775bdbe09270e9bf73d < 6637bbcfb59df5b732a79e5ab1a74886a0b93d59affected
LinuxLinuxd05cc5395e36711edad8bdef6945f138d8a7097b < 837c7a59fb58f81b0db33848357f6a5d0d1250adaffected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 7902b1df1520a0880bcda7a3704cfacd17905a83affected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 7318e3549518ce8f14776a489d86488d80d7e2c8affected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 449ec5fc99f45974525ba9eea16b6670c45cd363affected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < c36e206f302f1ddefed92d09ecbba070e1ae079eaffected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 41de342278ae025c99cc8d33648773f05e306cf1affected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 97fb7afec404912d967a7d4715f37742666b3084affected
LinuxLinuxe897be17a441fa637cd166fc3de1445131e57692 < 4a4e0328edd9e9755843787d28f16dd4165f8b48affected
LinuxLinux6c3da8c0a35bbafe359d9166269d5590f29664deaffected
LinuxLinux605babb979c213737618b1c837e89624e5ab11fdaffected
LinuxLinux307d021b1a7f33048b624f7aaeaa75e3eae571f1affected
LinuxLinux1829b24a36ca12ca95b96d5478faeff40c17f2b6affected
LinuxLinux5.10.118 < 5.10.258affected
LinuxLinux5.15.42 < 5.15.209affected
LinuxLinux4.14.296 < 4.15affected
LinuxLinux4.19.245 < 4.20affected
LinuxLinux5.4.196 < 5.5affected
LinuxLinux5.17.10 < 5.18affected
LinuxLinux5.18affected
LinuxLinux0 < 5.18unaffected
LinuxLinux5.10.258 <= 5.10.*unaffected
LinuxLinux5.15.209 <= 5.15.*unaffected
LinuxLinux6.1.175 <= 6.1.*unaffected
LinuxLinux6.6.136 <= 6.6.*unaffected
LinuxLinux6.12.83 <= 6.12.*unaffected
LinuxLinux6.18.24 <= 6.18.*unaffected
LinuxLinux6.19.14 <= 6.19.*unaffected
LinuxLinux7.0.1 <= 7.0.*unaffected
LinuxLinux7.1 <= *unaffected

Weaknesses

References