Executive brief
A vulnerability in the Linux kernel's OCFS2 file system could allow a local user to crash the system. The issue occurs when the system attempts to add a new storage group without properly verifying the user-provided input first. This can lead to a kernel panic, resulting in a complete system outage and potential data loss if unsaved work is present.
Technical details
A vulnerability exists in the OCFS2 file system's OCFS2_IOC_GROUP_ADD ioctl handler. The function ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before validating the block number via ocfs2_verify_group_and_input(). Because ocfs2_set_new_buffer_uptodate() asserts that the block is not already present in the metadata cache, a specially crafted input can trigger a BUG_ON (kernel panic). Additionally, the code incorrectly used the inode cache instead of the main bitmap inode cache. The fix ensures validation occurs before caching and uses the correct cache context.
Affected products
- Linux Linux kernel 7909f2bf8353 to f7e139d7563f6947ad509fb468903941d0bb7ddd
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/22544ddedf381ed5191cfc783aea8d6c936bc201
- https://git.kernel.org/stable/c/6c5e70409c1961fe1278968f038eaaed6cc1145a
- https://git.kernel.org/stable/c/70b672833f4025341c11b22c7f83778a5cd611bc
- https://git.kernel.org/stable/c/76bd722db0a92b84ccd99e03796a0b6f1ae71c31
- https://git.kernel.org/stable/c/aed87e866d1a321edb9703563c2faa8fec89835d
- https://git.kernel.org/stable/c/b9ae3942deec4c9e3fa2070521f90910f7490011
- https://git.kernel.org/stable/c/e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3