---
id: CVE-2026-90420
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nilfs2: fix infinite loop in nilfs_clean_segments()

  syzbot reported a hung task in nilfs_transaction_begin()
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nilfs2: fix infinite loop in nilfs_clean_segments()

  syzbot reported a hung task in nilfs_transaction_begin(). This occurs
  because the cleaner ioctl falls into an infin…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    e3e9367dae1a6392cbb14ab0b2ab5edbf39735c3
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    217b967ad7887a3e1ebc08f46f6484e081acd4b4
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    3bcdbdaac884a4baa59716cf9bd9470c75276e2d
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    d7afca8e4efbf4c455b4663c29ae59fde2f1b671
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    c07e5ad6539e7e9350d5c65cbf8adb69d1711b15
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    1fc6df85b4954b6fda9c351843aaca3c06f66d8d
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    8cea0bc78ac64cb88da49c07f80bf2cf9fb7aff8
  - >-
    Linux >= 9ff05123e3bfbb1d2b68ba1d9bf1f7d1dffc1453 <
    ce5a5ad1a8330a2fcfdd9ec2ab341be739e89a18
  - Linux 2.6.30
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:46.440'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90420'
references:
  - url: 'https://git.kernel.org/stable/c/1fc6df85b4954b6fda9c351843aaca3c06f66d8d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/217b967ad7887a3e1ebc08f46f6484e081acd4b4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/3bcdbdaac884a4baa59716cf9bd9470c75276e2d'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/8cea0bc78ac64cb88da49c07f80bf2cf9fb7aff8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c07e5ad6539e7e9350d5c65cbf8adb69d1711b15'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/ce5a5ad1a8330a2fcfdd9ec2ab341be739e89a18'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d7afca8e4efbf4c455b4663c29ae59fde2f1b671'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e3e9367dae1a6392cbb14ab0b2ab5edbf39735c3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.794Z'
epss: 0.0022
epssPercentile: 0.11245
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix infinite loop in nilfs_clean_segments()

syzbot reported a hung task in nilfs_transaction_begin(). This occurs
because the cleaner ioctl falls into an infinite loop if
nilfs_segctor_construct() repeatedly returns -EROFS (e.g. the device
is remounted as read-only after an I/O error).

Currently in nilfs_clean_segments(), if err is non-zero, it logs the
error and sleeps but doesn't abort when it encounters a terminal error
like -EROFS. This causes the thread to loop forever.

Fix this by breaking out of the loop if nilfs_segctor_construct()
returns -EROFS. This matches the behaviour in
nilfs_segctor_write_out(), which also handles -EROFS.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.