Executive brief
OCFS2 is a distributed filesystem used in Oracle clusters. During system shutdown, a race condition causes the kernel to attempt accessing the journal after it has been freed, resulting in a crash. This can lead to system instability or denial of service during unmount operations.
Technical details
A NULL pointer dereference occurs in the OCFS2 filesystem's ocfs2_checkpoint_inode() function during unmount. The vulnerability arises when ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL, but the VFS layer subsequently evicts cached inodes via ocfs2_evict_inode() → ocfs2_clear_inode() → ocfs2_checkpoint_inode() → ocfs2_ci_fully_checkpointed(), which dereferences the now-NULL osb->journal pointer. The fix adds a NULL check for osb->journal before dereferencing it; if the journal is NULL, the function returns early since the journal has already been fully flushed during shutdown. This is a local vulnerability triggered during normal filesystem unmount operations, patched in the Linux kernel stable tree.
Affected products
- Linux Linux kernel Multiple versions up to at least 6.18
Timeline
- 2026-08-15: disclosed
- 2026-05-31: patched: Fix committed upstream
- 2026-07-24: other: Backported to stable kernels