Executive brief
A vulnerability in the Linux kernel's OrangeFS file system driver can allow a local user to crash the system or corrupt files. The issue stems from a coding error in how the system handles extended file attributes, leading to infinite loops that consume all available processing power or cause the system to stop responding. This could result in a total loss of system availability and potential data corruption on affected storage volumes.
Technical details
A vulnerability exists in the `xattr_key()` helper function within `fs/orangefs/xattr.c` of the Linux kernel. The function incorrectly used a pointer variable as a loop condition (`while (key)`) instead of dereferencing it (`while (*key)`), causing the loop to continue indefinitely until it hits unmapped memory. This results in a kernel oops, thread hangs, and potential file corruption. Additionally, a secondary issue was identified where the use of the `hash_add` macro caused incorrect bucket assignment in the xattr cache, leading to a memory leak and eventual Out-Of-Memory (OOM) conditions during repeated attribute lookups. The fix involves correctly dereferencing the string pointer and migrating from `hash_add` to `hlist_add_head` for cache management.
Affected products
- Linux Linux Kernel 4.6 to 6.13.y
Timeline
- 2025-09-15: other: Patch authored
- 2025-12-08: disclosed: CVE published
References
- https://git.kernel.org/stable/c/025e880759c279ec64d0f754fe65bf45961da864
- https://git.kernel.org/stable/c/15afebb9597449c444801d1ff0b8d8b311f950ab
- https://git.kernel.org/stable/c/9127d1e90c90e5960c8bc72a4ce2c209691a7021
- https://git.kernel.org/stable/c/bc812574de633cf9a9ad6974490e45f6a4bb5126
- https://git.kernel.org/stable/c/c2ca015ac109fd743fdde27933d59dc5ad46658e
- https://git.kernel.org/stable/c/c6564ff6b53c9a8dc786b6f1c51ae7688273f931
- https://git.kernel.org/stable/c/e09a096104fc65859422817fb2211f35855983fe