In the Linux kernel, the following vulnerability has been resolved:
fs/omfs: reject ssysblocksize smaller than OMFSDIRSTART
omfsfillsuper() rejects oversized ssysblocksize values (> PAGESIZE), but it does not reject values smaller than OMFSDIR_START (0x1b8 = 440).
Later, omfsmakeempty() uses
sbi->s_sys_blocksize - OMFS_DIR_START
as the length argument to memset(). Since ssysblocksize is u32, a crafted filesystem image with ssysblocksize < OMFSDIRSTART causes an unsigned underflow there, wrapping to a value near 2^32. That drives a ~4 GiB memset() from bh->bdata + OMFSDIR_START and overwrites kernel memory far beyond the backing block buffer.
Add the corresponding lower-bound check alongside the existing upper-bound check in omfsfillsuper(), so that malformed images are rejected during superblock validation before any filesystem data is processed.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/53xxx/CVE-2026-53130.json"
}