Executive brief
The OCFS2 filesystem driver in the Linux kernel can crash during mount when encountering a corrupted journal metadata structure. An attacker with the ability to provide a malicious filesystem image could trigger a kernel panic during mount operations, causing a denial of service. The fix converts an uncontrolled crash into a graceful error handling path.
Technical details
A BUG_ON() macro in ocfs2_journal_toggle_dirty() (fs/ocfs2/journal.c:1034) crashes the kernel when the journal inode is detected to be invalid. The vulnerability exists because the function was changed from returning -EIO on validation failure to using BUG_ON(), assuming the journal dinode had already been validated. During mount teardown with a malformed OCFS2 image, the journal inode can become invalid, triggering the BUG_ON() and causing an uncontrolled kernel panic. The fix replaces BUG_ON() with WARN_ON() and restores the original -EIO return path, allowing graceful mount failure instead of panic. No remote network vector exists; this requires local access to mount a malicious OCFS2 image.
Affected products
- Linux Linux kernel all versions with commit 10995aa2451a through fix
Timeline
- 2026-08-28: disclosed