CVE-2026-80807

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: reject invalid block index in GC ioctl

Syzbot reported list corruption caused by a double list_add_tail() call on

bh->b_assoc_buffers within nilfs_lookup_dirty_data_buffers().

Analysis revealed that the root cause was the insertion of a page/folio

with a page index of ULONG_MAX into the page cache via the GC ioctl.

filemap_get_folios_tag(), called by nilfs_lookup_dirty_data_buffers(),

repeatedly detects a dirty folio with a page index of ULONG_MAX due to

index wrap-around, leading to duplicate processing of dirty buffers.

As a preparatory step, the GC ioctl loads the page/folio of the block to

be moved during GC and inserts it into the page cache based on information

in the nilfs_vdesc structure passed as an argument. Normally, this does

not cause issues because the user-space GC library configures the

nilfs_vdesc structure properly. However, since there is no range check on

the parameters determining the

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References