HIGH Introduced in 2.6.28
ocfs2 XattrBlock OOB
CVE-2026-90320
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
KernelScan AI7.0HIGH
01Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate external xattr entries when reading metadata ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check. Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time. The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target. Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_list_entries+0xd7/0x190 ocfs2_listxattr+0x3f6/0x610 listxattr+0x90/0xe0 path_listxattrat+0xed/0x220 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
02KernelScan AI Analysis
Risk summary
A local user who can call listxattr or getxattr on a file stored on a corrupted or maliciously crafted ocfs2 filesystem can trigger out-of-bounds reads of kernel heap memory, potentially disclosing sensitive kernel data or causing a kernel panic. Getting the crafted filesystem mounted requires root privileges or physical access to removable media.
Vulnerability analysis
The filesystem checks metadata headers when reading extended attributes from disk, but fails to verify that the number of entries and their data offsets actually fit inside the allocated storage block. Later, when listing or retrieving attributes, the kernel walks those entries and reads past the end of the buffer into unrelated kernel memory. The fix validates the bounds of attribute entries for both simple external blocks and larger indexed containers immediately after reading them from disk, rejecting malformed metadata before it is used. Any local user who can read a file on a mounted ocfs2 volume can trigger the flaw through standard extended-attribute system calls, but getting a corrupted filesystem mounted in the first place requires either an administrator mounting a crafted image or physical insertion of malicious storage.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 7.2 | 2.6.28 | 7.2.6 | 9f4129b6905b |
| mainline | 2.6.28 | 7.3-rc1 | 2cf82b46d5e4 |