Executive brief
A vulnerability in the Linux kernel's OCFS2 file system could allow a local user to cause a system crash. The issue occurs during specific file 'reflink' operations when cleaning up extended attributes. This could lead to a denial of service, impacting system availability.
Technical details
A logic error exists in the OCFS2 file system component of the Linux kernel during the cleanup of preserved extended attributes (xattr) when performing a reflink operation. Specifically, the 'last' pointer is not correctly shifted after an array entry cleanup, and the logic fails to clean up the first entry when the xattr count is one. This is a regression or incomplete fix for a previous issue (commit c06c303832ec). An attacker with local access could exploit this to trigger a kernel panic or denial of service. Patches have been released across multiple stable kernel branches.
Affected products
- Linux Linux kernel 2.6.32 to 5.10.252, 5.11 to 5.15.202, 5.16 to 6.1.165, 6.2 to 6.6.128, 6.7 to 6.12.75, 6.13 to 6.18.16, 6.19 to 6.19.6
Timeline
- 2026-05-06: advisory: Initial disclosure of CVE-2026-43168
- 2026-05-06: disclosed
- 2026-03-04: patched: Fixes committed to stable kernel trees
References
- https://git.kernel.org/stable/c/02acc9f72365e50eb45a56b7dacb9114ca3b503c
- https://git.kernel.org/stable/c/2f4daccd9d9b8b2952df7878df8c2e8ba6439398
- https://git.kernel.org/stable/c/3bdc3766aafb052aef4baadef455a84c1c0a059d
- https://git.kernel.org/stable/c/5138c936c2c82c9be8883921854bc6f7e1177d8c
- https://git.kernel.org/stable/c/8ff329353134280b203cb2bce95311cb8f7cbd8a
- https://git.kernel.org/stable/c/b2952dbeac2c3c527cb0519d5ffaeb95b062466a
- https://git.kernel.org/stable/c/bb273b68c1719c2925e05557f7e7099edb066680