CVE-2026-53130
fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START
Description
In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 6, 2026, 3:26 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to include the patch.
- Validate filesystem images during superblock processing.
- Apply lower-bound check for s_sys_blocksize.
- Reject malformed filesystem images.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53130.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53130 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53130
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53130 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53130 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 06, 2026
Action Type Old Value New Value Added CWE CWE-191 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.27 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': 'fbc72f5c645155dc2ed3573243ed20f9913e3a54', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '5822a05a841a10794ad818620dd2af490b0705d3', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '754ff1bea3819a90c6f33cccfc1a299ef7609f07', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '131ea3e57fc22936ed0e2c8330f2e36106172f51', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '79f84af38c9fef9deb0e02c79eb969b5541c2644', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '6561afc38398e3518a29c5eebb975c30468f98a6', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '817f16ed62bc58a168417bfb5e859c2a370bab03', 'versionType': 'git'}, {'status': 'affected', 'version': 'a3ab7155ea21aadc8a4d5687e91b3d876973185e', 'lessThan': '0621c385fda1376e967f37ccd534c26c3e511d14', 'versionType': 'git'}], 'programFiles': ['fs/omfs/inode.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.27'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.27', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/omfs/inode.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed. Added Reference https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14 Added Reference https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51 Added Reference https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3 Added Reference https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6 Added Reference https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07 Added Reference https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644 Added Reference https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03 Added Reference https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54