CVE-2026-31577

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

State: Published
Severity: Not scored
Published: Apr 24, 2026
Updated: Jun 14, 2026
Reserved: Mar 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix NULL i_assoc_inode dereference in nilfs_mdt_save_to_shadow_map

The DAT inode's btree node cache (i_assoc_inode) is initialized lazily during btree operations. However, nilfs_mdt_save_to_shadow_map() assumes i_assoc_inode is already initialized when copying dirty pages to the shadow map during GC.

If NILFS_IOCTL_CLEAN_SEGMENTS is called immediately after mount before any btree operation has occurred on the DAT inode, i_assoc_inode is NULL leading to a general protection fault.

Fix this by calling nilfs_attach_btree_node_cache() on the DAT inode in nilfs_dat_read() at mount time, ensuring i_assoc_inode is always initialized before any GC operation can use it.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	d626fcdabea2258be395a775bdbe09270e9bf73d to before 6637bbcfb59df5b732a79e5ab1a74886a0b93d59Affected d05cc5395e36711edad8bdef6945f138d8a7097b to before 837c7a59fb58f81b0db33848357f6a5d0d1250adAffected e897be17a441fa637cd166fc3de1445131e57692 to before 7902b1df1520a0880bcda7a3704cfacd17905a83Affected e897be17a441fa637cd166fc3de1445131e57692 to before 7318e3549518ce8f14776a489d86488d80d7e2c8Affected e897be17a441fa637cd166fc3de1445131e57692 to before 449ec5fc99f45974525ba9eea16b6670c45cd363Affected e897be17a441fa637cd166fc3de1445131e57692 to before c36e206f302f1ddefed92d09ecbba070e1ae079eAffected e897be17a441fa637cd166fc3de1445131e57692 to before 41de342278ae025c99cc8d33648773f05e306cf1Affected e897be17a441fa637cd166fc3de1445131e57692 to before 97fb7afec404912d967a7d4715f37742666b3084Affected e897be17a441fa637cd166fc3de1445131e57692 to before 4a4e0328edd9e9755843787d28f16dd4165f8b48Affected 6c3da8c0a35bbafe359d9166269d5590f29664deAffected 605babb979c213737618b1c837e89624e5ab11fdAffected 307d021b1a7f33048b624f7aaeaa75e3eae571f1Affected 1829b24a36ca12ca95b96d5478faeff40c17f2b6Affected 5.10.118 to before 5.10.258Affected 5.15.42 to before 5.15.209Affected 4.14.296 to before 4.15Affected 4.19.245 to before 4.20Affected 5.4.196 to before 5.5Affected 5.17.10 to before 5.18Affected
LinuxLinux	5.18Affected before 5.18Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0.1 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

d626fcdabea2258be395a775bdbe09270e9bf73d to before 6637bbcfb59df5b732a79e5ab1a74886a0b93d59Affected
d05cc5395e36711edad8bdef6945f138d8a7097b to before 837c7a59fb58f81b0db33848357f6a5d0d1250adAffected
e897be17a441fa637cd166fc3de1445131e57692 to before 7902b1df1520a0880bcda7a3704cfacd17905a83Affected
e897be17a441fa637cd166fc3de1445131e57692 to before 7318e3549518ce8f14776a489d86488d80d7e2c8Affected
e897be17a441fa637cd166fc3de1445131e57692 to before 449ec5fc99f45974525ba9eea16b6670c45cd363Affected
e897be17a441fa637cd166fc3de1445131e57692 to before c36e206f302f1ddefed92d09ecbba070e1ae079eAffected
e897be17a441fa637cd166fc3de1445131e57692 to before 41de342278ae025c99cc8d33648773f05e306cf1Affected
e897be17a441fa637cd166fc3de1445131e57692 to before 97fb7afec404912d967a7d4715f37742666b3084Affected
e897be17a441fa637cd166fc3de1445131e57692 to before 4a4e0328edd9e9755843787d28f16dd4165f8b48Affected
6c3da8c0a35bbafe359d9166269d5590f29664deAffected
605babb979c213737618b1c837e89624e5ab11fdAffected
307d021b1a7f33048b624f7aaeaa75e3eae571f1Affected
1829b24a36ca12ca95b96d5478faeff40c17f2b6Affected
5.10.118 to before 5.10.258Affected
5.15.42 to before 5.15.209Affected
4.14.296 to before 4.15Affected
4.19.245 to before 4.20Affected
5.4.196 to before 5.5Affected
5.17.10 to before 5.18Affected

LinuxLinux

5.18Affected
before 5.18Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0.1 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.