Executive brief
The Linux kernel's OCFS2 filesystem implementation does not properly reserve metadata when setting large extended file attributes (xattrs) on fragmented filesystems, causing a kernel panic. This affects systems using OCFS2 storage that attempt to set large xattr values, resulting in service unavailability through an uncontrolled kernel crash.
Technical details
The vulnerability is a missing metadata reservation in ocfs2_calc_xattr_set_need() when an xattr block already exists on the file. When setting a large xattr value on a fragmented filesystem, the code fails to reserve sufficient metadata blocks for the extent tree, leaving meta_ac NULL. On fragmented storage, large xattr values require multiple extent records; when the extent list fills and meta_ac is NULL, ocfs2_add_clusters_in_btree() returns RESTART_META, triggering a BUG_ON() that crashes the kernel. The fix adds consistent metadata reservation for large xattr values and replaces the BUG_ON with a -ENOSPC error return. The vulnerability is triggered by the lsetxattr() syscall, requires a file with an existing external xattr block on a fragmented OCFS2 filesystem, and is now fixed in the stable kernel branches.
Affected products
- Linux Linux Kernel Multiple versions (patch available in stable branches)
Timeline
- 2026-09-04: disclosed
- 2026-08-27: patched: Stable kernel commit 04ba24bce61c917b5b3009f0db470cbb72e26a0d