CVE-2026-53041

What it actually does

This is a Linux kernel OCFS2 filesystem flaw in extended attribute listing. When an OCFS2 inode contains both inline and block-based extended attributes, and the caller supplies a listxattr() buffer that is exactly filled by the inline attribute names, the OCFS2 block-attribute pass can incorrectly continue accounting names beyond the remaining buffer size. The kernel may then attempt an invalid copy_to_user() operation and trigger a hardened usercopy BUG/Oops in mm/usercopy.c, resulting in a kernel crash or service disruption. The impact is denial of service; the provided details do not indicate privilege escalation, remote code execution, or data disclosure.

Why it matters to the business

Systems using OCFS2 can be crashed by a user or workload able to manipulate extended attributes on an OCFS2-mounted filesystem, causing downtime for applications that depend on the affected host or clustered filesystem. Because OCFS2 is commonly used in clustered or shared-storage deployments, a crash may have operational impact beyond a single process and can disrupt availability-sensitive services. The vulnerability is not currently listed in CISA KEV, is not known to be used in ransomware campaigns, has low EPSS, and has no reported exploit maturity, so remediation should be handled through normal kernel patching priorities unless OCFS2 is exposed to untrusted local users or multi-tenant workloads.

How an attack unfolds

An attacker needs the ability to access an OCFS2-mounted filesystem and create or modify extended attributes on files or directories. They prepare an inode with a combination of inline extended attributes and block-based extended attributes. They then call listxattr() with a destination buffer sized so that the inline attribute names consume the buffer exactly. Due to incorrect probe-mode detection in the OCFS2 xattr listing path, the block-based xattr pass continues processing with a non-NULL buffer and zero remaining space, returns a size larger than the provided buffer, and triggers the kernel hardened usercopy checks during copy_to_user(). On vulnerable kernels this can produce a kernel BUG/Oops and crash the system or destabilize the node.

How to fix it

Apply a Linux kernel update that includes the OCFS2 fix for listxattr() buffer-full handling. The corrected behavior detects probe mode by checking whether the destination buffer pointer is NULL rather than relying on the remaining size being zero, and returns -ERANGE when the supplied buffer is exhausted. No exact fixed package versions were provided, so use the vendor kernel advisory for the affected distribution or kernel branch and deploy the first version containing the OCFS2 xattr listxattr() fix. If immediate patching is not possible, reduce exposure by unmounting OCFS2 where it is not required, restricting access to OCFS2-mounted paths, preventing untrusted users or containers from setting extended attributes on OCFS2, and limiting local shell or workload access on systems that mount OCFS2.

How to confirm the fix worked

Confirm whether the running kernel includes the OCFS2 fix from the relevant vendor or upstream stable branch. Inventory systems for mounted OCFS2 filesystems using mount output, /proc/mounts, or filesystem management tooling. After patching, verify the active kernel version after reboot, not only the installed package version. For exposure validation, confirm whether OCFS2 is mounted and whether untrusted users, containers, or applications can create files and set extended attributes on those mounts. In a controlled non-production environment, a regression test can create an OCFS2 inode with both inline and block-based xattrs and call listxattr() with an exactly full buffer; a fixed kernel should return an error such as -ERANGE rather than producing a kernel BUG/Oops.

Typical attack path

1. Gain local code execution or application-level file-write capability on a system with an OCFS2 filesystem mounted.
2. Create or select a file or directory on OCFS2 where extended attributes can be set.
3. Add enough inline extended attribute names to exactly fill a chosen listxattr() output buffer.
4. Add additional block-based extended attributes to the same inode.
5. Invoke listxattr() with the crafted buffer size.
6. Trigger the OCFS2 xattr accounting bug, causing a hardened usercopy failure and kernel BUG/Oops.
7. Cause denial of service through kernel crash, node reboot, or filesystem service disruption.

How to detect it

Review kernel logs, crash dumps, and system journals for signs of a kernel BUG/Oops in the hardened usercopy path involving listxattr() and OCFS2. Useful sources include dmesg, journalctl -k, /var/log/kern.log, /var/log/messages, /var/log/syslog, kdump/vmcore analysis, audit logs for setxattr/listxattr-heavy activity if syscall auditing is enabled, and EDR telemetry that records process syscalls or abnormal host reboots. Look for crashes with call traces containing usercopy_abort, __check_object_size, copy_to_user, listxattr, filename_listxattr, path_listxattrat, and OCFS2 xattr functions. Also investigate repeated creation or modification of extended attributes on OCFS2-mounted paths immediately before a crash. There are no public attacker-specific network indicators for this issue; detection is primarily host-based and crash-artifact based.

• kernel BUG at mm/usercopy.c:102
• usercopy_abort
• Oops: invalid opcode
• __check_heap_object
• __check_object_size
• copy_to_user
• listxattr+
• filename_listxattr
• path_listxattrat
• __x64_sys_listxattr
• ocfs2_xattr_list_entry
• ocfs2_listxattr
• ocfs2
• OCFS2
• -ERANGE

What your security team should do

• Identify all Linux systems that have OCFS2 mounted or the OCFS2 kernel module available and prioritize those with untrusted local users, container workloads, or shared application write access.
• Patch affected kernels through the operating system or kernel vendor and reboot systems so the fixed kernel is active.
• Where patching is delayed, restrict write and extended-attribute operations on OCFS2 mounts to trusted service accounts only.
• Disable or unload OCFS2 on systems where it is not required, and remove unnecessary OCFS2 mounts from boot-time configuration.
• Monitor kernel logs for usercopy_abort, OCFS2 xattr, listxattr, and kernel BUG/Oops patterns that may indicate attempted exploitation or accidental triggering.
• Treat unexplained crashes on OCFS2 hosts as potentially security-relevant until kernel logs and filesystem activity are reviewed.
• Because this issue is not KEV-listed, not associated with ransomware use, and has low EPSS, prioritize based on OCFS2 usage and local/multi-tenant exposure rather than internet exposure.