{
  "cveId": "CVE-2026-64359",
  "url": "https://patchblox.com/security/cve/CVE-2026-64359",
  "summary": "CVE-2026-64359 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64359, released July 26, 2026. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  nilfs2: reject CLEAN_SEGMENTS ioctl with out-of-range segment numbers  Syzbot reported a hung task in nilfs_transaction_begin() where multiple tasks performing chmod() on a nilfs2 mount blocked for over 143 seconds waiting to acquire ns_segctor_sem for read:    INFO: task syz.0.17:5918 blocked for more than 143 seconds.   Call Trace:    schedule\u002B0x164/0x360    rwsem_down_read_slowpath\u002B0x6d9/0x940    down_read\u002B0x99/0x2e0    nilfs_transaction_begin\u002B0x364/0x710 fs/nilfs2/segment.c:221    nilfs_setattr\u002B0x124/0x2c0 fs/nilfs2/inode.c:921    notify_change\u002B0xc1a/0xf40    chmod_common\u002B0x273/0x4a0    do_fchmodat\u002B0x12d/0x230  The writer holding ns_segctor_sem was a concurrent NILFS_IOCTL_CLEAN_SEGMENTS caller, stuck inside printk while emitting per-element warnings from nilfs_sufile_updatev():     __nilfs_msg\u002B0x373/0x450 fs/nilfs2/super.c:78    nilfs_sufile_updatev\u002B0x21c/0x6d0 fs/nilfs2/sufile.c:186    nilfs_sufile_freev fs/nilfs2/sufile.h:93 [inline]    nilfs_free_segments fs/nilfs2/segment.c:1140 [inline]    nilfs_segctor_collect_blocks fs/nilfs2/segment.c:1261 [inline]    nilfs_segctor_do_construct\u002B0x1f55/0x76c0    nilfs_clean_segments\u002B0x3bd/0xa50    nilfs_ioctl_clean_segments fs/nilfs2/ioctl.c:922 [inline]    nilfs_ioctl\u002B0x261f/0x2780  The root cause is that user-supplied segment numbers are not validated before nilfs_clean_segments() begins doing work; the range check on each segnum is performed deep inside the call chain by nilfs_sufile_updatev(), which emits a nilfs_warn() per invalid entry while still holding the segctor lock and the sufile mi_sem.  Under load (repeated invocations across multiple mounts saturating the global printk path), the cumulative printk latency keeps ns_segctor_sem held long enough to trip the hung_task watchdog, blocking concurrent operations such as chmod() that need ns_segctor_sem for read.  Fix by validating the contents of kbufs[4] in nilfs_clean_segments() immediately after acquiring ns_segctor_sem via nilfs_transaction_lock(). Holding ns_segctor_sem serializes the check against nilfs_ioctl_resize(), which can modify ns_nsegments, so the validation uses a consistent value.  Out-of-range segment numbers are rejected with -EINVAL before any segment-cleaning work begins, so the bad entries never reach the per-element diagnostic path inside nilfs_sufile_updatev().",
  "published": "2026-07-25T10:17:18Z",
  "severity": "medium",
  "cvss": 5.5,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.00123,
  "epssPercentile": 0.02039,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.180-1",
      "fix": "DEBIAN-CVE-2026-64359",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64359",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.96-1",
      "fix": "DEBIAN-CVE-2026-64359",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64359",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-64359",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64359",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.100-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-64359",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64359",
      "released": "2026-07-26T13:52:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}