Look up another CVE · open CVE-2026-53130 in the interactive tracker

CVE-2026-53130

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

7.8 EPSS 0.2% AV:L

Published 2026-06-24 (4 months ago) by the Linux kernel CNA. Subsystem fs/omfs. Debian urgency: not yet assigned.

What to do, per Debian release

Debian's own status for CVE-2026-53130 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source

Release	Status	Version	What this means
Debian 12bookworm	fixedDLA-4665-1 · 2026-07-03 · text	6.1.176-1	Update the kernel and reboot. DLA-4665-1 shipped the fix on 2026-07-03, in 6.1.176-1. A running kernel keeps the old code until the machine restarts.
Debian 13trixie	fixed	6.12.94-1	Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts.
Debian 14forky	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.
Debian unstablesid	fixed	7.0.10-1	Update the kernel and reboot. Fixed in 7.0.10-1. A running kernel keeps the old code until the machine restarts.

The vulnerability

What the bug is

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE), but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440). Later, omfs_make_empty() uses sbi->s_sys_blocksize - OMFS_DIR_START as the length argument to memset(). Since s_sys_blocksize is u32, a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel memory far beyond the backing block buffer. Add the corresponding lower-bound check alongside the existing upper-bound check in omfs_fill_super(), so that malformed images are rejected during superblock validation before any filesystem data is processed.

Where it lives

The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.

fs/omfs/inode.c

What this is: OMFS FILESYSTEMMAINTAINERS section matched on fs/omfs/ · linux-karma-devel@lists.sourceforge.net · Maintained
Kernel module: omfs

Check it on the machine

grep -w CONFIG_OMFS_FS /boot/config-$(uname -r)

Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.

lsmod | grep -w omfs

Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.

Show whether Debian builds this, per release

Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.

bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64

M: a module where it is built at all; some flavours do not build it

Build switch: CONFIG_OMFS_FS

From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages

Debian tracker CVE record NVD kernel CNA record

Signals

Published: 2026-06-24 (4 months ago)source
CVSS: 7.8 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it
Attack vector: local (AV:L)source
EPSS: 0.19%, higher than 7.7% of all CVEssource
CISA KEV: not listedthe KEV catalogue
Debian urgency: not yet assignedsource
Subsystem: fs/omfs

Upstream fixes

The versions the CNA records as introducing and fixing this, and the commit for each. source

Introduced	Fixed in	Commit
2.6.27	5.10.258	fbc72f5c6451
2.6.27	5.15.209	5822a05a841a
2.6.27	6.1.175	754ff1bea381
2.6.27	6.6.141	131ea3e57fc2
2.6.27	6.12.91	79f84af38c9f
2.6.27	6.18.33	6561afc38398
2.6.27	7.0.10	817f16ed62bc
2.6.27	7.1	0621c385fda1

Debian advisories

Advisory	Date	Shipped to	Debian
DLA-4671-1	2026-07-05	bullseye 6.1.176-1~deb11u1	tracker
DLA-4665-1	2026-07-03	bookworm 6.1.176-1	tracker
DLA-4664-1	2026-07-03	bullseye 5.10.259-1	tracker

Why the CNA scored it this way

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local: Exploitation requires a crafted OMFS block filesystem image to be mounted and then operated on locally; there is no network packet or adjacent-radio path into this filesystem code.
AC:LAttack complexity, low: A crafted image with s_sys_blocksize below OMFS_DIR_START can deterministically reach the underflow when a directory is created; there is no race or condition outside attacker control beyond having OMFS support present.
PR:NPrivileges required, none: Although direct self-mounting OMFS requires CAP_SYS_ADMIN in the initial namespace and is not reachable through user namespaces, the highest reasonable crafted-image scenario requires no attacker account or privileges and relies on a victim/privileged mount workflow.
UI:RUser interaction, required: A user or privileged automount-like workflow must mount the crafted OMFS image and perform an operation such as directory creation on it before omfs_make_empty() is reached.
S:UScope, unchanged: The corruption occurs within the Linux kernel on the same host security authority and does not cross a VM, IOMMU, or other scope boundary.
C:HConfidentiality impact, high: The bug is a massive kernel out-of-bounds write, and successful exploitation of kernel memory corruption can yield kernel code execution or privilege escalation with access to confidential data.
I:HIntegrity impact, high: The unsigned underflow drives a near-4 GiB memset past the buffer_head data, corrupting arbitrary kernel memory beyond the filesystem buffer.
A:HAvailability impact, high: The oversized kernel memset can corrupt critical memory and reliably cause an oops, panic, hang, or other full system denial of service.