{"id":"CVE-2026-55392","aliases":["AZL-90200","DEBIAN-CVE-2026-55392","EUVD-2026-37927","GHSA-f559-vgh2-9hj6","MGASA-2026-0280","OESA-2026-2795","OESA-2026-2796","OESA-2026-2797","OESA-2026-2840","UBUNTU-CVE-2026-55392","openSUSE-SU-2026:11094-1","openSUSE-SU-2026:21183-1"],"status":"published","title":"NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","severity":{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00151,"percentile":0.04256,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1284"],"published":"2026-06-18T18:00:12Z","modified":"2026-11-05T05:36:30Z","fixes":[{"ecosystem":"Mageia:10","package":"nilfs-utils","fixed_in":["2.2.11-3.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"nilfs-utils","fixed_in":["2.2.9-1.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"nilfs-utils","fixed_in":["2.2.8-2.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"nilfs-utils","fixed_in":["2.2.9-2.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"nilfs-utils","fixed_in":["2.2.9-2.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"nilfs-utils","fixed_in":["2.2.7-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"nilfs-utils","fixed_in":["2.3.1-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"nilfs-utils","fixed_in":["2.2.9-bp160.2.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.2.11-4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-1","2.2.11-2","2.2.9-1"]},{"source":"osv","ecosystem":"Debian:13","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Debian:14","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Mageia:10","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.11-3.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-1.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.8-2.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-2.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.7-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.3-2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.6-1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.7-1","2.2.8-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.8-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.9-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2build1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"nilfs-tools","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.2.11-2","2.2.11-2build1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.1-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"nilfs-utils","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.2.9-bp160.2.1"}]}]}],"products":[{"vendor":"nilfs-dev","product":"nilfs-utils"}],"references":[{"url":"https://github.com/nilfs-dev/nilfs-utils/issues/26","tags":["issue-tracking","report"]},{"url":"https://github.com/nilfs-dev/nilfs-utils/commit/26efb5daff0757365101035145331b0a5a85d9d9","tags":["patch","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55392","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f559-vgh2-9hj6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/55xxx/CVE-2026-55392.json","tags":["advisory"]},{"url":"https://github.com/nilfs-dev/nilfs-utils","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-55392","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0280.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=35759","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/547QU7QRINNSB7HMT4YKQIJSKLUMGGKV/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2795","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2796","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2797","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2840","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-55392","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-55392","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2026-55392","tags":["web"]},{"url":"https://bugzilla.suse.com/1268553","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-55392","title":"NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T18:00:12.736Z","modified":"2026-07-14T21:33:59.224Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:20:11.925815Z"}],"euvd":[{"id":"EUVD-2026-37927","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T18:00:12Z","modified":"2026-07-14T21:33:59Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:19:58.306277Z"}],"ghsa":[{"id":"GHSA-f559-vgh2-9hj6","title":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to...","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T21:32:34Z","modified":"2026-06-18T21:32:34Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:08:54.452189Z"}],"nvd":[{"id":"CVE-2026-55392","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T19:16:23.63Z","modified":"2026-10-26T11:10:00.157Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T14:12:24.912854Z"}],"osv":[{"id":"CVE-2026-55392","title":"NILFS utilities - Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T18:00:12.736Z","modified":"2026-10-28T11:14:53.74664132Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1284"],"updated_at":"2026-11-02T15:45:11.22012Z"},{"id":"DEBIAN-CVE-2026-55392","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T19:16:23.63Z","modified":"2026-10-27T09:47:30.878307686Z","cvss":[{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:57.590991Z"},{"id":"OESA-2026-2795","title":"nilfs-utils security update","description":"Userspace utilities for creating and mounting NILFS v2 filesystems.\r\n\r\nSecurity Fix(es):\n\nNILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.(CVE-2026-55392)","status":"published","published":"2026-06-24T11:11:43Z","modified":"2026-08-18T01:21:12.152022107Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2796","title":"nilfs-utils security update","description":"Userspace utilities for creating and mounting NILFS v2 filesystems.\r\n\r\nSecurity Fix(es):\n\nNILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.(CVE-2026-55392)","status":"published","published":"2026-06-24T11:11:43Z","modified":"2026-08-18T01:21:12.160828808Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2797","title":"nilfs-utils security update","description":"Userspace utilities for creating and mounting NILFS v2 filesystems.\r\n\r\nSecurity Fix(es):\n\nNILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.(CVE-2026-55392)","status":"published","published":"2026-06-24T11:11:43Z","modified":"2026-08-18T01:21:12.155720884Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"OESA-2026-2840","title":"nilfs-utils security update","description":"Userspace utilities for creating and mounting NILFS v2 filesystems.\r\n\r\nSecurity Fix(es):\n\nNILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.(CVE-2026-55392)","status":"published","published":"2026-07-06T11:11:45Z","modified":"2026-08-18T01:21:14.025597233Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:52:46.823443Z"},{"id":"UBUNTU-CVE-2026-55392","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T19:16:00Z","modified":"2026-10-17T12:59:08.650953397Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"},{"version":"4.0","score":6.7,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:41.382716Z"},{"id":"AZL-90200","title":"CVE-2026-55392 affecting package nilfs-utils 2.2.11-4","description":"NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.","status":"published","published":"2026-06-18T19:16:23Z","modified":"2026-11-05T05:36:30Z","updated_at":"2026-11-05T16:41:25.633663Z"},{"id":"MGASA-2026-0280","title":"Updated nilfs-utils packages fix security vulnerability","description":"Undefined Behavior and Out-of-Memory via Unvalidated s_log_block_size.\n(CVE-2026-55392)\n","status":"published","published":"2026-07-20T19:06:32Z","modified":"2026-07-20T19:15:06.459958183Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11094-1","title":"libnilfs3-2.3.1-1.1 on GA media","description":"These are all security issues fixed in the libnilfs3-2.3.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-06-22T00:00:00Z","modified":"2026-06-24T09:00:22.381208058Z","updated_at":"2026-11-02T16:58:38.95195Z"},{"id":"openSUSE-SU-2026:21183-1","title":"Security update for nilfs-utils","description":"This update for nilfs-utils fixes the following issues:\n\nChanges in nilfs-utils:\n\n- CVE-2026-55392: Fixed undefined behavior in nilfs_sb_is_valid() (bsc#1268553)\n\n","status":"published","published":"2026-06-30T11:30:56Z","modified":"2026-07-02T18:24:18.964106649Z","updated_at":"2026-11-02T16:58:41.885092Z"}]}}