CVE-2026-90418

Summary

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status.

This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode.

Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

Affected Software

VendorProductVersion RangeStatus
LinuxLinux8c26c4e2694a163d525976e804d81cd955bbb40c < 5166a21b12f549774f2983fa86d2526ea9e66aceaffected
LinuxLinux8c26c4e2694a163d525976e804d81cd955bbb40c < 4e1f21e7540b25d83f86b50780836ed7d2afcc93affected
LinuxLinux8c26c4e2694a163d525976e804d81cd955bbb40c < 3904fb0ee741ebbbc27ec8f50a9bb6cd31e8af05affected
LinuxLinux8c26c4e2694a163d525976e804d81cd955bbb40c < f181155baf0c93a74ebe804c6cecbe970e78ee9eaffected
LinuxLinux8c26c4e2694a163d525976e804d81cd955bbb40c < 66f4ad3ce158902e5f98afea93189972ed8750c2affected
LinuxLinux3.10affected
LinuxLinux0 < 3.10unaffected
LinuxLinux6.6.157 <= 6.6.*unaffected
LinuxLinux6.12.110 <= 6.12.*unaffected
LinuxLinux6.18.52 <= 6.18.*unaffected
LinuxLinux7.2.6 <= 7.2.*unaffected
LinuxLinux7.3-rc1 <= *unaffected

Weaknesses

References