nilfs2 SuperRoot OOB

Vulnerability analysis

When mounting a nilfs2 filesystem, the inode size field from the on-disk superblock is trusted without verifying that the computed on-disk footprint of the super-root inode fits within a single filesystem block. A crafted image can set an inode size large enough that the inode parsing routine reads beyond the end of the allocated block buffer, exposing adjacent kernel memory or hitting unmapped pages and crashing the kernel. The fix adds a validation check during filesystem layout setup that rejects any inode size whose computed super-root size exceeds the block size, returning an error before the vulnerable parsing path is reached. This bug is only reachable by mounting a crafted nilfs2 filesystem image, which requires real CAP_SYS_ADMIN in the init namespace — nilfs2 is not mountable inside user namespaces — so the realistic trigger is either physical insertion of removable media or a privileged user manually mounting a malicious image.