Executive brief
The Linux kernel's OCFS2 file system contains a bug in how it manages buffer heads during block reads. When validation of metadata fails, the code fails to properly mark buffers as invalid, allowing corrupted or stale metadata to be cached and returned to upper layers. This could lead to file system corruption or data loss if an attacker or race condition causes validation failures.
Technical details
The vulnerability is a race condition and state management bug in the ocfs2_read_blocks() function in fs/ocfs2/buffer_head_io.c. The root cause is that when a buffer head validation callback detects data inconsistency, the BH_Uptodate flag is not cleared immediately. This allows the buffer head to remain marked as valid in memory, and on subsequent calls to sb_getblk(), the same buffer can be returned unchanged with BH_Uptodate still set, bypassing validation. The fix clears the BH_Uptodate flag immediately when validate() returns an error, ensuring stale or corrupt metadata cannot propagate into the OCFS2 metadata cache. No authentication is required; the vulnerability affects any process reading OCFS2 file system blocks.
Affected products
- Linux Linux Kernel multiple versions (patch applied across linux-2.6.11.y through linux-7.2.y and rolling branches)
Timeline
- 2026-09-04: disclosed: Disclosed as CVE-2026-80881
- 2026-05-29: patched: Upstream fix commit 6371a07148ee979af22a9d6f4c277462953a9a4a by Dmitry Antipov
- 2026-07-24: patched: Stable kernel patches applied