Executive brief
The Linux kernel's OCFS2 file system driver did not properly validate extended attributes (xattr) metadata during inode block reads. An attacker with ability to craft a malicious OCFS2 file system could trigger a use-after-free vulnerability when the system attempts to read or list extended attributes, potentially causing a kernel crash or information disclosure.
Technical details
The vulnerability is a use-after-free (CWE-416) in the OCFS2 xattr handling code. The root cause is insufficient validation of inline xattr entry name/value bounds when inode blocks are read and validated. The ocfs2_validate_inode_block() function checked inline xattr header placement and entry count, but did not validate whether individual xattr entry offsets remained within allocated inline storage. This allowed corrupted metadata to bypass validation at read time, leading to out-of-bounds memory access when ocfs2_xattr_find_entry() later attempted to walk the xattr entries during getxattr() or listxattr() operations. The fix adds flat xattr entry validator calls during inode block validation to reject corrupted entries before they can be accessed. A precondition is that the attacker must provide or control a crafted OCFS2 file system image.
Affected products
- Linux Linux kernel prior to patch
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched