CVE-2026-90418

Not scored yetLast modified Oct 30, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix BUG in nilfs_copy_dirty_pages() on dirty state mismatch

Syzbot reported a kernel BUG triggered within nilfs_copy_dirty_pages(), which copies dirty DAT file folios/pages to its shadow page cache. The BUG occurs when a retrieved dirty folio/page unexpectedly loses its 'dirty' status.

This issue arises because, since the commit referenced below, the 'dirty' flag of a folio/page can be cleared asynchronously after the filesystem detects metadata corruption and transitions to read-only mode.

Resolve the issue by returning an -EROFS error if the filesystem has transitioned to read-only mode. Also change the behavior to issue a kernel warning only once instead of triggering a kernel BUG when this unexpected 'dirty' state is detected while the filesystem is not in read-only mode.

Metrics

No CVSS score has been published yet.

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 8c26c4e2694a163d525976e804d81cd955bbb40c, < 6879c603a8d07af82da83768cc2342a11bd444e5; >= 8c26c4e2694a163d525976e804d81cd955bbb40c, < 5166a21b12f549774f2983fa86d2526ea9e66ace; >= 8c26c4e2694a163d525976e804d81cd955bbb40c, < 4e1f21e7540b25d83f86b50780836ed7d2afcc93; >= 8c26c4e2694a163d525976e804d81cd955bbb40c, < 3904fb0ee741ebbbc27ec8f50a9bb6cd31e8af05; >= 8c26c4e2694a163d525976e804d81cd955bbb40c, < f181155baf0c93a74ebe804c6cecbe970e78ee9e; >= 8c26c4e2694a163d525976e804d81cd955bbb40c, < 66f4ad3ce158902e5f98afea93189972ed8750c2
LinuxLinux3.10

References

Timeline

Published
Sep 17, 2026
Last modified
Oct 30, 2026
NVD status
Received

Related CVEs from 2026

CVE-2026-904197.1In the Linux kernel, the following vulnerability has been resolved: nilfs2: prevent out-of-bounds read in super root block parsing super-rCVE-2026-90420In the Linux kernel, the following vulnerability has been resolved: nilfs2: fix infinite loop in nilfs_clean_segments() syzbot reported a CVE-2026-90421In the Linux kernel, the following vulnerability has been resolved: PCI: Fix UAF when probe runs concurrent to dyn ID removal Dynamic IDs CVE-2026-90422In the Linux kernel, the following vulnerability has been resolved: clk: mediatek: pllfh: Fix IO remapping leak in register_pllfhs error paCVE-2026-904237.8In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: Fix UAF in ODP init error-handling path rxe_odp_mr_init_userCVE-2026-90424In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Fix VINTF0 leak on the init-failure path tegra24CVE-2026-904258.8In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID tegra24CVE-2026-90426In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Free the error IRQ before tearing down VINTFs teCVE-2026-904277.4In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't fall back to a freed smmu after devm_kreallCVE-2026-90428In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Don't run the error ISR before probe sets up vintCVE-2026-904297.8In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Synchronize the error ISR against VINTF (de)init CVE-2026-90430In the Linux kernel, the following vulnerability has been resolved: iommu/tegra241-cmdqv: Publish an LVCMDQ only after it is fully initiali
CVE-2026-90418: Unscored | Vulnix