Cloudanix VulnDB

CVE-2026-80881

None

CVSS

—

EPSS

0.2%

Published

Sep 4, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A flaw in the Linux kernel's OCFS2 filesystem code could let bad data slip into the system's storage cache, risking crashes or corrupted files.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Data Tampering
Component
OS kernel
Class
Memory Corruption
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Incorrect buffer head reuse in ocfs2_read_blocks() allows a BH_Uptodate buffer containing previously invalidated data to enter the OCFS2 metadata cache when put_bh() does not drop the reference count to zero.

Why it matters to the business

Filesystem metadata corruption or kernel instability can occur during OCFS2 operations on Linux, potentially affecting storage availability and data integrity in clustered environments.

How an attack unfolds

An attacker triggers repeated calls to sb_getblk() under conditions where a prior validation failure occurred; the stale buffer with BH_Uptodate set is returned and inserted into the metadata cache, allowing inconsistent data to reach upper layers.

How to fix it

Apply the upstream kernel patch that clears BH_Uptodate immediately after a failed validate() callback in ocfs2_read_blocks(); rebuild and reboot with the fixed kernel.

How to confirm the fix worked

Confirm the patch is present by inspecting the ocfs2_read_blocks() function for the BH_Uptodate clear after validation failure; test by forcing validation errors and verifying the buffer is not reused with stale state.

Typical attack path

  1. Trigger ocfs2_read_blocks() with input that fails validate()
  2. Ensure b_count remains greater than 1 so put_bh() does not release the buffer
  3. Force a subsequent sb_getblk() call to return the same buffer head
  4. Insert the stale buffer into the OCFS2 metadata cache
  5. Submit the inconsistent buffer to upper filesystem layers

How to detect it

Review kernel logs for OCFS2 validation failure messages followed by unexpected metadata cache insertions; examine buffer head handling traces around sb_getblk and put_bh calls.

What your security team should do

  • Prioritize patching Linux kernels containing OCFS2 on all systems using that filesystem
  • Monitor upstream stable kernel releases for the fix and schedule rapid deployment
  • Audit environments for OCFS2 usage and consider alternative filesystems if patching is delayed

The record

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller should't assume that buffer head returned by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops b_count from 1 to 0. If it is not so, buffer head remains on hold and likely to be returned by the next call to 'sb_getblk()' unchanged - that is, with BH_Uptodate bit set even if it has failed validation previously, thus allowing to insert that buffer head into OCFS2 metadata cache and submit it to upper layers. To avoid such a scenario, BH_Uptodate should be cleared immediately after 'validate()' callback has detected some data inconsistency.

Affected packages

Ecosystem Package Introduced Fixed