---
cve: "CVE-2026-53130"
severity: "HIGH"
cvss: 7.8
epss: "13%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-06-24 17:17:28"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-07T09:24:02+02:00"
---

# CVE-2026-53130

> 7.8 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START

omfs_fill_super() rejects oversized s_sys_blocksize values (> PAGE_SIZE),
but it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).

Later, omfs_make_empty() uses

    sbi->s_sys_blocksize - OMFS_DIR_START

as the length argument to memset().  Since s_sys_blocksize is u32,
a crafted filesystem image with s_sys_blocksize < OMFS_DIR_START causes
an unsigned underflow there, wrapping to a value near 2^32.  That drives
a ~4 GiB memset() from bh->b_data + OMFS_DIR_START and overwrites kernel
memory far beyond the backing block buffer.

Add the corresponding lower-bound check alongside the existing upper-bound
check in omfs_fill_super(), so that malformed images are rejected during
superblock validation before any filesystem data is processed.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Erforderlich | good |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.258
- Kernel ≥ 5.15.209
- Kernel ≥ 6.1.175
- Kernel ≥ 6.6.141
- Kernel ≥ 6.12.91
- Kernel ≥ 6.18.33
- Kernel ≥ 7.0.10

## Referenzen

- <https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54>
- <https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3>
- <https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07>
- <https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51>
- <https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644>
- <https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6>
- <https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03>
- <https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-53130) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_