Executive brief
A vulnerability in the Linux kernel's OCFS2 file system component could allow a local user to crash the system. By using a specially crafted file system image, an attacker can trigger a kernel panic during a disk resize operation. This results in a denial-of-service condition, potentially disrupting business operations and data availability.
Technical details
A vulnerability exists in the ocfs2_group_extend() function within the Linux kernel's OCFS2 file system driver. The function assumes that global bitmap inode blocks returned from ocfs2_inode_lock() are already validated; however, JBD2-managed buffer paths can bypass these structural checks. By providing a crafted filesystem with an invalid dinode signature, a local attacker can trigger a BUG_ON() macro, resulting in a kernel panic (denial of service). The fix involves adding explicit validation for the dinode in ocfs2_group_extend() and returning an error instead of crashing. This issue is reachable via the resize ioctl.
Affected products
- Linux Linux kernel 2.6.29 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1
Timeline
- 2026-04-24: disclosed
- 2026-04-24: advisory
- 2026-04-15: patched: Initial patch commit in mainline/stable branches
References
- https://git.kernel.org/stable/c/10fb72c47aac446f12a4ccd962c7daa60cc890a1
- https://git.kernel.org/stable/c/41c6e9bc3a09539deab43957a3211d902a4818f0
- https://git.kernel.org/stable/c/4a1c0ddc6e7bcf2e9db0eeaab9340dcfe97f448f
- https://git.kernel.org/stable/c/6575f9fbf084502b7118a628425bf7866666498d
- https://git.kernel.org/stable/c/7eafcf507fbd68f3276c00f6c02ef155ad69f79b
- https://git.kernel.org/stable/c/911b557dd7817460881fd51a03069b539c674d0e
- https://git.kernel.org/stable/c/b328d8e7c437d0f026ba2c13788af6eae77700f1