CVE-2026-53130: Linux Kernel OMFS Integer Underflow Allows Kernel Memory Corruption

Technical summary

The vulnerability exists in omfs_fill_super(), which validates the s_sys_blocksize field from the OMFS superblock against an upper bound (PAGE_SIZE) but fails to enforce a lower bound (OMFS_DIR_START, or 0x1b8 = 440 bytes). When omfs_make_empty() later executes, it computes sbi->s_sys_blocksize - OMFS_DIR_START as a memset() length parameter. Since s_sys_blocksize is unsigned (u32), a crafted image with s_sys_blocksize < OMFS_DIR_START causes an integer underflow, wrapping the result to approximately 2^32 - (OMFS_DIR_START - s_sys_blocksize). This enormous value drives a ~4 GiB memset() from bh->b_data + OMFS_DIR_START, corrupting kernel memory far beyond the allocated buffer. The fix adds a corresponding lower-bound check in omfs_fill_super() to reject malformed superblocks during validation, before any filesystem processing occurs.

Business impact

Organizations relying on Linux systems that auto-mount untrusted filesystems (removable media, network shares, container images) face elevated risk. Exploitation causes immediate denial of service and potential privilege escalation. In multi-tenant or container environments, a compromised user could mount a crafted image to crash the host kernel or elevate privileges. Development teams and CI/CD pipelines that process arbitrary filesystem images should prioritize patching to prevent supply chain attacks leveraging crafted OMFS images.

Affected systems

The vulnerability affects the Linux kernel across all versions that include the OMFS filesystem driver. The fix must be applied to any kernel built with CONFIG_OMFS enabled. Most mainstream distributions (RHEL, Ubuntu, Debian, SUSE) include this driver by default. Verify your kernel configuration with 'grep CONFIG_OMFS /boot/config-$(uname -r)' or equivalent. Embedded systems, NAS devices, and appliances using custom kernels may also be affected depending on driver inclusion.

Exploitability

Exploitation requires local access and the ability to provide a malformed OMFS filesystem image to a target system. The attack surface includes: mounting untrusted removable media (USB drives, external disks), processing crafted filesystem images in containers or VMs, or mounting network shares controlled by an attacker. No special privileges are required to trigger the vulnerability—UI:R in the CVSS vector indicates user interaction (mounting) is needed, but the operation itself requires no elevated permissions. Once triggered, the impact is immediate and severe (kernel memory corruption, crash, or potential code execution).

Remediation

Apply the upstream Linux kernel patch that adds the lower-bound check to omfs_fill_super(). This patch rejects OMFS superblocks with s_sys_blocksize < OMFS_DIR_START (440 bytes) during mount validation, preventing the underflow condition. Patch availability and backport schedules vary by distribution; check your vendor's security advisory for the specific kernel version containing the fix. As an interim mitigation, disable the OMFS driver if not required (blacklist omfs module or rebuild kernel without CONFIG_OMFS), restrict mounting of untrusted filesystems via AppArmor/SELinux policies, and validate filesystem images before processing.

Patch guidance

Monitor your Linux vendor's security bulletins (Red Hat, Canonical, SUSE, Arch, etc.) for kernel updates addressing CVE-2026-53130. The fix is a minimal validation addition and should incur no performance impact. Verify the patched kernel version against your vendor's advisory to confirm the fix is included. For systems where custom kernels are built, cherry-pick the upstream patch from the Linux kernel repository (apply the omfs_fill_super() bound check). Test in a non-production environment to ensure OMFS-dependent workloads (if any) continue to function. Prioritize patching for systems that mount or process untrusted filesystem images.

Detection guidance

Monitor kernel logs (dmesg, journalctl) for mount failures on OMFS images with suspicious s_sys_blocksize values. System call tracing (auditd, strace) can capture mount() attempts with crafted images. Memory corruption warnings (kernel sanitizers if compiled in) or sudden kernel crashes following OMFS mount attempts may indicate exploitation. Implement filesystem image validation policies and scan for OMFS images in CI/CD pipelines. Network-based detection is limited; focus on endpoint logging of mount operations and image provenance tracking.

Why prioritize this

This vulnerability merits HIGH priority due to its CVSS 7.8 score, local attack vector requiring minimal privilege, and severe impact (kernel memory corruption, DoS, potential privilege escalation). While exploitation requires user interaction (mounting a malformed image), the barrier to providing such an image is low in environments handling untrusted media or container images. The fix is simple and low-risk, making patching straightforward. Organizations should patch promptly, especially if OMFS is enabled and untrusted storage is regularly processed.

Risk score, explained

CVSS 7.8 (HIGH) reflects: AV:L (local attack only, not network-exploitable), AC:L (no special conditions beyond a crafted filesystem), PR:N (no elevated privileges required), UI:R (user must mount the filesystem, but this is normal and often automatic), and S:U/C:H/I:H/A:H (high confidentiality, integrity, and availability impact—kernel memory corruption). The score appropriately reflects the severity of kernel-level memory corruption but is tempered by the local-only attack vector.

Frequently asked questions