{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "a3ab7155ea21aadc8a4d5687e91b3d876973185e"
            },
            {
              "fixed": "fbc72f5c645155dc2ed3573243ed20f9913e3a54"
            },
            {
              "fixed": "5822a05a841a10794ad818620dd2af490b0705d3"
            },
            {
              "fixed": "754ff1bea3819a90c6f33cccfc1a299ef7609f07"
            },
            {
              "fixed": "131ea3e57fc22936ed0e2c8330f2e36106172f51"
            },
            {
              "fixed": "79f84af38c9fef9deb0e02c79eb969b5541c2644"
            },
            {
              "fixed": "6561afc38398e3518a29c5eebb975c30468f98a6"
            },
            {
              "fixed": "817f16ed62bc58a168417bfb5e859c2a370bab03"
            },
            {
              "fixed": "0621c385fda1376e967f37ccd534c26c3e511d14"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.27"
            },
            {
              "fixed": "5.10.258"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.209"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.175"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.141"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.91"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.33"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53130.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START\n\nomfs_fill_super() rejects oversized s_sys_blocksize values (\u003e PAGE_SIZE),\nbut it does not reject values smaller than OMFS_DIR_START (0x1b8 = 440).\n\nLater, omfs_make_empty() uses\n\n    sbi-\u003es_sys_blocksize - OMFS_DIR_START\n\nas the length argument to memset().  Since s_sys_blocksize is u32,\na crafted filesystem image with s_sys_blocksize \u003c OMFS_DIR_START causes\nan unsigned underflow there, wrapping to a value near 2^32.  That drives\na ~4 GiB memset() from bh-\u003eb_data + OMFS_DIR_START and overwrites kernel\nmemory far beyond the backing block buffer.\n\nAdd the corresponding lower-bound check alongside the existing upper-bound\ncheck in omfs_fill_super(), so that malformed images are rejected during\nsuperblock validation before any filesystem data is processed.",
  "id": "CVE-2026-53130",
  "modified": "2026-07-08T05:36:58.248239185Z",
  "published": "2026-06-24T16:30:57.227Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/0621c385fda1376e967f37ccd534c26c3e511d14"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/131ea3e57fc22936ed0e2c8330f2e36106172f51"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5822a05a841a10794ad818620dd2af490b0705d3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6561afc38398e3518a29c5eebb975c30468f98a6"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/754ff1bea3819a90c6f33cccfc1a299ef7609f07"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/79f84af38c9fef9deb0e02c79eb969b5541c2644"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/817f16ed62bc58a168417bfb5e859c2a370bab03"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/fbc72f5c645155dc2ed3573243ed20f9913e3a54"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53130.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-53130"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.7.5",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "fs/omfs: reject s_sys_blocksize smaller than OMFS_DIR_START"
}