Executive brief
A vulnerability in the Linux kernel's OCFS2 file system component could allow a local user to crash the system. The issue occurs when the system attempts to list extended file attributes and miscalculates the required memory buffer size. This results in a kernel panic (system crash), which can disrupt operations and lead to a denial of service.
Technical details
A vulnerability exists in the OCFS2 file system's listxattr implementation due to incorrect logic in ocfs2_xattr_list_entry(). The function incorrectly used 'size == 0' to detect probe mode (where the caller asks for the required buffer size). If an inode contains both inline and block-based xattrs and the inline attributes exactly fill the provided buffer, the subsequent block-xattr pass proceeds with a remaining size of zero but a non-NULL buffer. This causes the function to skip bounds checks and return a size larger than the allocated buffer, eventually triggering a 'usercopy_abort' kernel BUG during the copy_to_user operation. An attacker with local access could exploit this to cause a denial of service (system crash). The fix changes the probe mode detection to check for a NULL buffer pointer instead of a zero size.
Affected products
- Linux Linux Kernel ocfs2 module
Timeline
- 2026-04-10: disclosed: Initial patch submission by ZhengYuan Huang
- 2026-06-01: patched: Patch committed to stable tree by Greg Kroah-Hartman
- 2026-06-24: advisory: CVE-2026-53041 published
References
- https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe
- https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff
- https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b
- https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a
- https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d
- https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a
- https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59