CVE-2026-55392

Name	CVE-2026-55392
Description	NILFS utilities through 2.3.0, fixed in commit 26efb5d, nilfs_sb_is_valid() function fails to validate s_log_block_size field in NILFS2 superblock before bit-shift operations. Attackers supplying crafted NILFS2 images trigger undefined behavior through oversized shifts or out-of-memory conditions, crashing tools like nilfs-tune and dumpseg.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
Debian Bugs	1140362

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
nilfs-tools (PTS)	bullseye	2.2.8-1	vulnerable
	bookworm	2.2.9-1	vulnerable
	forky, sid, trixie	2.2.11-2	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
nilfs-tools	source	(unstable)	(unfixed)	unimportant		1140362

Notes

https://github.com/nilfs-dev/nilfs-utils/issues/26
Fixed by: https://github.com/nilfs-dev/nilfs-utils/commit/26efb5daff0757365101035145331b0a5a85d9d9
Crash in CLI tool, no security impact