CVE-2026-31577 nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
A local attacker can trigger a kernel crash by invoking a specific ioctl immediately after mounting a nilfs2 filesystem, causing a denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31577?
CVE-2026-31577 is a medium-severity vulnerability in Linux kernel, published on 24 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map
The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC.
If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault.
Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.
Weakness: CWE-476
Which versions are affected by CVE-2026-31577?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31577?
Apply the vendor's patch.
Is CVE-2026-31577 being exploited?
There is no known exploitation of CVE-2026-31577 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83723, BELL-CVE-2026-31577, DEBIAN-CVE-2026-31577, GHSA-9pgh-55q5-rvp6, ROOT-OS-DEBIAN-11-CVE-2026-31577, ROOT-OS-DEBIAN-12-CVE-2026-31577 and 4 more.