Cloudanix VulnDB

CVE-2026-90320

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the Linux kernel checks certain file metadata on OCFS2 storage could let someone who can supply a bad disk image crash the system or run their own code.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds validation on external xattr block headers and bucket entry offsets in ocfs2 allows out-of-range reads or use-after-free when listxattr/getxattr walk corrupted metadata.

Why it matters to the business

Systems using the OCFS2 filesystem face risk of kernel crashes, memory corruption, or local code execution that can disrupt clustered storage workloads and require emergency patching.

How an attack unfolds

An attacker supplies a malicious OCFS2 volume containing specially crafted external xattr blocks, causes the target to mount or access it, then invokes listxattr or getxattr to trigger the unchecked entry walks that produce the KASAN use-after-free.

How to fix it

Upgrade to a kernel containing the ocfs2 xattr block and bucket validators; rebuild and reboot affected nodes; verify OCFS2 volumes are not mounted until patched kernels are deployed.

How to confirm the fix worked

Confirm the running kernel includes the xattr metadata validation changes; attempt to reproduce the original KASAN report with a crafted image and verify the report no longer occurs.

Typical attack path

  1. Craft OCFS2 filesystem image with invalid xh_count or out-of-bounds xattr entry offsets
  2. Induce the victim system to mount the image or open files on it
  3. Execute listxattr or getxattr system calls against the malicious metadata
  4. Trigger kernel path through ocfs2_xattr_list_entries or equivalent that performs the out-of-bounds access

How to detect it

Search kernel logs and KASAN reports for stack traces containing ocfs2_xattr_list_entries, ocfs2_listxattr, or ocfs2_validate_xattr_block; monitor for unexpected mounts of OCFS2 volumes from untrusted sources.

  • BUG: KASAN: use-after-free in ocfs2_xattr_list_entries
  • ocfs2_xattr_list_entries+0xd7/0x190
  • ocfs2_listxattr+0x3f6/0x610

What your security team should do

  • Identify all systems running OCFS2 and schedule immediate kernel updates
  • Block untrusted OCFS2 images from being mounted until patches are applied
  • Add kernel crash and KASAN monitoring for ocfs2 xattr functions to detect attempted exploitation

The record

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check. Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time. The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target. Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_list_entries+0xd7/0x190 ocfs2_listxattr+0x3f6/0x610 listxattr+0x90/0xe0 path_listxattrat+0xed/0x220 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f

Affected packages

Ecosystem Package Introduced Fixed