Executive brief
A vulnerability in the Linux kernel's OCFS2 filesystem code allows a local attacker to trigger a use-after-free condition when listing or reading extended attributes (xattr) on corrupted filesystems. An attacker with filesystem-level access could cause a kernel crash or potentially execute arbitrary code by crafting a malicious OCFS2 filesystem with out-of-bounds xattr entry offsets.
Technical details
This vulnerability is a use-after-free bug in the OCFS2 xattr handling code (fs/ocfs2/xattr.c). The root cause is insufficient validation of external xattr block metadata: ocfs2_validate_xattr_block() checks the xattr block header but does not verify that entry counts and offsets fit within block boundaries. When listxattr() or getxattr() syscalls walk the xattr entry arrays, malformed offsets can cause out-of-bounds memory access. The fix adds two validators: ocfs2_validate_xattr_entries_flat() for non-indexed blocks and ocfs2_validate_xattr_bucket() for indexed buckets, both invoked during metadata read time. Attack requires local filesystem-level access (reading a crafted filesystem image) or ability to corrupt a mounted OCFS2 filesystem.
Affected products
- Linux Linux kernel Multiple versions (patch backported across 2.6.11 through 6.x stable series)
Timeline
- 2026-09-17: disclosed: Published in NVD
- 2026-07-05: patched: Upstream commit 2cf82b46d5e43be0dfbaac7fa1073cec2fc1f5e6
- 2026-09-14: patched: Backported to stable trees (commit 9f4129b6905b7d638bbc9eb8013c3989cbe30b7e)