Cloudanix VulnDB

CVE-2026-90321

High · 7.8

CVSS

7.8

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how the OCFS2 file system checks internal file metadata could let someone with local access crash the computer or potentially run their own code.

Exploitation
Requires User Interaction
Attacker needs
User Interaction
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Improper Input Validation
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Missing bounds validation on inline extended attribute name/value offsets and counts inside OCFS2 dinode blocks allows out-of-bounds memory accesses (use-after-free or slab read) when getxattr/listxattr walk corrupted xattr metadata.

Why it matters to the business

Local users on OCFS2 volumes can trigger kernel crashes or potential code execution; clusters using OCFS2 for shared storage face elevated availability and integrity risk until kernels are updated.

How an attack unfolds

An attacker with local access crafts or corrupts an OCFS2 inode block containing inline xattrs so that name/value offsets point outside the inline storage area; when any process later calls getxattr or listxattr on that inode the kernel walks the malformed array, hitting the KASAN-reported use-after-free in ocfs2_xattr_find_entry.

How to fix it

Apply the upstream patch series that adds flat xattr entry validation inside ocfs2_validate_inode_block(); rebuild and boot a kernel containing this fix for all systems using OCFS2.

How to confirm the fix worked

Confirm the patched ocfs2_validate_inode_block() now calls the new xattr entry bounds checker before any ibody xattr walk; attempt to mount and access xattrs on a deliberately malformed OCFS2 image and verify the kernel no longer reports KASAN use-after-free in ocfs2_xattr_find_entry.

Typical attack path

  1. Obtain local shell on a system mounting an OCFS2 volume
  2. Create or modify a file whose inode block will contain inline xattrs
  3. Corrupt the inode block (via direct block device write, another kernel bug, or malicious image)
  4. Trigger vfs_getxattr or listxattr on the affected file
  5. Kernel performs out-of-bounds memory access leading to crash or potential exploitation

How to detect it

Search kernel logs for KASAN reports referencing ocfs2_xattr_find_entry, ocfs2_xattr_get_nolock, or BUG in ocfs2 xattr paths; monitor for unexpected OCFS2 filesystem errors or crashes on systems that recently accessed extended attributes.

  • BUG: KASAN: use-after-free in ocfs2_xattr_find_entry
  • ocfs2_xattr_get_nolock+0x20a
  • Read of size 2 at addr .* by task python3

What your security team should do

  • Identify all hosts mounting OCFS2 filesystems and schedule kernel updates
  • Prioritize systems where untrusted local users can create files or where OCFS2 images may be attacker-supplied
  • Add OCFS2 inode validation failures to kernel log monitoring until patches are deployed

The record

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxattr() or listxattr() can walk out-of-range entry arrays or offsets from corrupted metadata. This patch (of 2): ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk metadata from it, but inline xattr metadata is still checked only in operation-specific consumers. The existing ibody lookup helper validates inline header placement and entry count, but inode block validation does not reject entry name/value bounds. Add a flat xattr entry validator and call it from inode block validation for inline xattrs. Keep the operation paths on their existing header/count lookup checks; the full entry bounds check now runs when the inode block is validated at read time. Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or listxattr() can walk past the inline storage. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170 Read of size 2 at addr ffff8881242a2000 by task python3/529 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_find_entry+0x5a/0x170 ocfs2_xattr_get_nolock+0x20a/0x820 ocfs2_xattr_get+0x10c/0x1e0 __vfs_getxattr+0xe2/0x130 vfs_getxattr+0x185/0x1b0

Affected packages

Ecosystem Package Introduced Fixed