7.8
HIGH CVSS 3.1
CVE-2026-53130
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
Description

In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

INFO

Published Date :

June 24, 2026, 5:17 p.m.

Last Modified :

July 6, 2026, 3:26 p.m.

Remotely Exploit :

No

Source :

416baaa9-dc9f-4396-8d5f-8c081fb06d67
Affected Products

The following products are affected by CVE-2026-53130 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Linux linux_kernel
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.
Score Version Severity Vector Exploitability Score Impact Score Source
CVSS 3.1 HIGH 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
Patch the Linux kernel to validate filesystem block size limits during superblock validation.
  • Update the Linux kernel to include the patch.
  • Validate filesystem images during superblock processing.
  • Apply lower-bound check for s_sys_blocksize.
  • Reject malformed filesystem images.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2026-53130 is associated with the following CWEs:

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2026-53130 weaknesses.

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2026-53130 vulnerability anywhere in the article.

The following table lists the changes that have been made to the CVE-2026-53130 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • Initial Analysis by [email protected]

    Jul. 06, 2026

    Action Type Old Value New Value
    Added CWE CWE-191
    Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.27 up to (excluding) 5.10.258
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03 Types: Patch
    Added Reference Type kernel.org: https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54 Types: Patch
  • CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 28, 2026

    Action Type Old Value New Value
    Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
  • New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67

    Jun. 24, 2026

    Action Type Old Value New Value
    Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': 'fbc72f5c645155dc2ed3573243ed20f9913e3a54', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '5822a05a841a10794ad818620dd2af490b0705d3', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '754ff1bea3819a90c6f33cccfc1a299ef7609f07', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '131ea3e57fc22936ed0e2c8330f2e36106172f51', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '79f84af38c9fef9deb0e02c79eb969b5541c2644', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '6561afc38398e3518a29c5eebb975c30468f98a6', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '817f16ed62bc58a168417bfb5e859c2a370bab03', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '0621c385fda1376e967f37ccd534c26c3e511d14', 'versionType': 'git'}], 'programFiles': ['fs/omfs/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.27'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.27', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/omfs/inode.c'], 'defaultStatus': 'affected'}]
    Added Description In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.
    Added Reference https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14
    Added Reference https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51
    Added Reference https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3
    Added Reference https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6
    Added Reference https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07
    Added Reference https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644
    Added Reference https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03
    Added Reference https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.