CVE-2026-53130

Analyzed Analyzed - Analysis Complete

Buffer Overflow in Linux Kernel OMFS Filesystem

Publication date: 2026-06-24

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-06

Generated

2026-07-16

AI Q&A

2026-06-24

EPSS Evaluated

2026-07-15

NVD

CVE-2026-53130

EUVD

EUVD-2026-38998

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.27 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-191	The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's omfs filesystem code. Specifically, the function omfs_fill_super() properly rejects s_sys_blocksize values that are larger than PAGE_SIZE, but it does not reject values smaller than OMFS_DIR_START (440).

Because s_sys_blocksize is an unsigned 32-bit integer, if a crafted filesystem image sets s_sys_blocksize to a value smaller than OMFS_DIR_START, an unsigned underflow occurs when omfs_make_empty() calculates the length argument for memset(). This causes memset() to overwrite approximately 4 GiB of kernel memory beyond the intended buffer, potentially corrupting kernel memory.

The fix involves adding a lower-bound check in omfs_fill_super() to reject malformed filesystem images before any data is processed.

Detection Guidance

This vulnerability involves a crafted OMFS filesystem image with an s_sys_blocksize value smaller than OMFS_DIR_START (0x1b8). Detection would require inspecting OMFS filesystem images for this specific malformed s_sys_blocksize value.

Since the vulnerability is related to the Linux kernel's handling of OMFS filesystem superblocks, detection on a system could involve checking mounted OMFS filesystems or filesystem images for the s_sys_blocksize field.

However, no specific detection commands or network detection methods are provided in the available information.

Impact Analysis

This vulnerability can lead to a large memory overwrite in kernel space, which may cause system instability, crashes, or potentially allow an attacker to execute arbitrary code with kernel privileges.

Because the vulnerability involves overwriting kernel memory far beyond the intended buffer, it can be exploited by an attacker who can supply a crafted filesystem image, potentially leading to privilege escalation or denial of service.

Mitigation Strategies

To mitigate this vulnerability, ensure that your Linux kernel is updated to a version where the fix has been applied. The fix involves adding a lower-bound check in the omfs_fill_super() function to reject malformed OMFS filesystem images with s_sys_blocksize values smaller than OMFS_DIR_START, preventing unsafe memory operations.

Avoid mounting untrusted or crafted OMFS filesystem images that could exploit this vulnerability until the kernel is patched.

Hi! I’m here to help you understand CVE-2026-53130. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70