Executive brief
A vulnerability was identified in the Linux kernel's OCFS2 file system component that could lead to system instability or data corruption. The issue occurs when the system handles large direct I/O write operations, potentially exhausting the 'credits' used to track file system changes. If a system crash occurs during these operations, it could leave the file system in an inconsistent state with stale data blocks.
Technical details
A vulnerability in the OCFS2 file system's direct I/O (DIO) completion path (`ocfs2_dio_end_io_write`) can cause JBD2 credit exhaustion. When processing a large number of extents, the transaction may request more credits than the journal's maximum limit, triggering a kernel warning or failure in `jbd2__journal_restart`. Additionally, the improper ordering of orphan inode removal (`ocfs2_del_inode_from_orphan`) relative to extent tree updates created a window where a system crash could leave stale blocks beyond the end-of-file (EOF). The fix implements transaction batching for extent handling and reorders orphan list management to ensure atomicity and consistency.
Affected products
- Linux Linux kernel All versions supporting OCFS2
Timeline
- 2026-04-02: patched: Initial patch submitted by Heming Zhao
- 2026-05-27: advisory: CVE-2026-46080 published by kernel.org and NVD
References
- https://git.kernel.org/stable/c/069c3fb310e9336cf48cfdf8748a32c29fd0193d
- https://git.kernel.org/stable/c/3c636a3edca9c3f180b3079f94fe7e115730d9c6
- https://git.kernel.org/stable/c/886f97fa59d0bbfa9859fb1a66dd9e014b522d89
- https://git.kernel.org/stable/c/d647c5b2fbf81560818dacade360abc8c00a9665
- https://git.kernel.org/stable/c/ea5bb1d20da756e4f41a48dad42b2e7d6e73f71e