Cloudanix VulnDB

CVE-2026-80809

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A flaw in the OCFS2 filesystem driver can let a local user crash the entire system by adding a large extended attribute on a fragmented disk.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Low
Impact
Denial Of Service
Component
OS kernel
Class
Other
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing metadata block reservation in ocfs2_calc_xattr_set_need() when an external xattr block already exists allows ocfs2_xattr_extend_allocation() to receive RESTART_META and trigger BUG_ON during lsetxattr on fragmented filesystems, causing a kernel panic.

Why it matters to the business

Local users can crash systems using the OCFS2 filesystem, leading to denial of service, unplanned reboots, and potential data corruption risk on shared cluster storage.

How an attack unfolds

An attacker with write access to an OCFS2 filesystem creates or modifies a file that already has an external xattr block, then calls setxattr with a large value that requires multiple non-contiguous extents on a fragmented volume; the missing reservation causes the allocator to return RESTART_META and the kernel to panic instead of returning an error.

How to fix it

Apply the upstream patch that adds ocfs2_extend_meta_needed reservation for the existing-block case and replaces the BUG_ON with -ENOSPC; upgrade to a kernel containing the fix for CVE-2026-80809.

How to confirm the fix worked

Confirm the presence of the corrected ocfs2_calc_xattr_set_need logic and absence of the BUG_ON in ocfs2_xattr_extend_allocation; test lsetxattr of large values on fragmented OCFS2 volumes to ensure graceful -ENOSPC instead of panic.

Typical attack path

  1. Obtain local shell or process on a system mounting OCFS2
  2. Identify or create a file with an existing external xattr block on a fragmented volume
  3. Invoke lsetxattr with a value large enough to require additional extent records
  4. Trigger the BUG_ON in ocfs2_xattr_extend_allocation and cause kernel panic

How to detect it

Search kernel logs for OCFS2 BUG_ON messages referencing xattr_extend_allocation or RESTART_META; inspect audit logs for unusual setxattr calls on OCFS2 mounts from non-administrative users.

  • BUG_ON(why == RESTART_META)
  • ocfs2_xattr_extend_allocation
  • ocfs2_calc_xattr_set_need

What your security team should do

  • Prioritize kernel updates for any systems using OCFS2 in production or shared storage environments
  • Restrict untrusted local accounts from mounting or writing to OCFS2 volumes until patched
  • Monitor for OCFS2-related kernel oops and panics as a temporary detection measure

The record

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs [BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. [CAUSE] ocfs2_calc_xattr_set_need() never reserves metadata blocks for a new xattr value's extent tree when the file already has an external xattr block. The not_found path leaves meta_add at zero, so meta_ac is NULL when ocfs2_xattr_extend_allocation() runs. A new value root has room for a single extent record. On a fragmented filesystem, the allocator cannot satisfy the xattr value in one contiguous run, so each non-contiguous run requires its own extent record. When the value root's extent list is full and meta_ac is NULL, ocfs2_add_clusters_in_btree() returns RESTART_META, and ocfs2_xattr_extend_allocation() hits BUG_ON(why == RESTART_META). [FIX] The case where no xattr block exists yet already calls ocfs2_extend_meta_needed(&def_xv.xv.xr_list) to reserve value tree metadata. Add the same reservation to the case where an xattr block already exists, making the two cases consistent. Replace the BUG_ON with a -ENOSPC return so that if RESTART_META is returned despite the reservation, the error propagates to userspace instead of panicking the kernel.

Affected packages

Ecosystem Package Introduced Fixed