CVE-2026-90321 (GCVE-0-2026-90321)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
ocfs2: validate inline xattrs during inode block validation
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxattr() or listxattr() can walk out-of-range entry arrays or offsets from corrupted metadata. This patch (of 2): ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk metadata from it, but inline xattr metadata is still checked only in operation-specific consumers. The existing ibody lookup helper validates inline header placement and entry count, but inode block validation does not reject entry name/value bounds. Add a flat xattr entry validator and call it from inode block validation for inline xattrs. Keep the operation paths on their existing header/count lookup checks; the full entry bounds check now runs when the inode block is validated at read time. Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or listxattr() can walk past the inline storage. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170 Read of size 2 at addr ffff8881242a2000 by task python3/529 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_find_entry+0x5a/0x170 ocfs2_xattr_get_nolock+0x20a/0x820 ocfs2_xattr_get+0x10c/0x1e0 __vfs_getxattr+0xe2/0x130 vfs_getxattr+0x185/0x1b0
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: cf1d6c763fbcb115263114302485ad17e7933d87 , < 3fd45b24879fa4885b66a582a6e47eda67f11310 (git)
Affected: cf1d6c763fbcb115263114302485ad17e7933d87 , < 8914a3330b72378136c2c02d6328a826f6abdad7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.28
Unaffected: 0 , < 2.6.28 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c",
            "fs/ocfs2/xattr.c",
            "fs/ocfs2/xattr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3fd45b24879fa4885b66a582a6e47eda67f11310",
              "status": "affected",
              "version": "cf1d6c763fbcb115263114302485ad17e7933d87",
              "versionType": "git"
            },
            {
              "lessThan": "8914a3330b72378136c2c02d6328a826f6abdad7",
              "status": "affected",
              "version": "cf1d6c763fbcb115263114302485ad17e7933d87",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c",
            "fs/ocfs2/xattr.c",
            "fs/ocfs2/xattr.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.28"
            },
            {
              "lessThan": "2.6.28",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.28",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline xattrs during inode block validation\n\nPatch series \"ocfs2: validate xattr entry bounds\", v7.\n\nThis series validates OCFS2 xattr entry name/value bounds when xattr\nmetadata is read and validated, before getxattr() or listxattr() can walk\nout-of-range entry arrays or offsets from corrupted metadata.\n\n\nThis patch (of 2):\n\nocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk\nmetadata from it, but inline xattr metadata is still checked only in\noperation-specific consumers.  The existing ibody lookup helper validates\ninline header placement and entry count, but inode block validation does\nnot reject entry name/value bounds.\n\nAdd a flat xattr entry validator and call it from inode block validation\nfor inline xattrs.  Keep the operation paths on their existing\nheader/count lookup checks; the full entry bounds check now runs when the\ninode block is validated at read time.\n\nReject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or\nlistxattr() can walk past the inline storage.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170\nRead of size 2 at addr ffff8881242a2000 by task python3/529\nCall Trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  kasan_report+0xe0/0x110\n  ocfs2_xattr_find_entry+0x5a/0x170\n  ocfs2_xattr_get_nolock+0x20a/0x820\n  ocfs2_xattr_get+0x10c/0x1e0\n  __vfs_getxattr+0xe2/0x130\n  vfs_getxattr+0x185/0x1b0"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The malformed bytes are dinode inline-xattr xe_name_offset, xe_name_len and xe_value_size, read from the inode block by ocfs2_read_inode_block() into ocfs2_validate_inode_block() and later walked by ocfs2_xattr_ibody_get()/ocfs2_xattr_ibody_list(); no o2net, NFS, or SMB message carries those offsets.\nAC:L - A crafted dinode with OCFS2_INLINE_XATTR_FL and attacker-chosen xe_name_offset/xe_value_size is sufficient; after mount, getxattr(2) reaches vfs_getxattr()\u2192ocfs2_xattr_get()\u2192ocfs2_xattr_find_entry() and hits the reported KASAN UAF with no race or other condition outside the attacker\u2019s control.\nPR:N - ocfs2_fs_type.fs_flags has no FS_USERNS_MOUNT, so the attacker cannot self-mount; ocfs2_xa_set() writes well-formed inline entries, so planting a bad xe_name_offset needs a crafted image. After the victim\u2019s ocfs2_fill_super(), listxattr(2) calls ocfs2_listxattr() with no MAY_READ/DAC check.\nUI:R - The inline xattr payload is inert until a victim mounts the crafted OCFS2 image through ocfs2_fill_super(); getxattr(2) or listxattr(2) on that volume is the follow-on action that reaches ocfs2_xattr_find_entry() or ocfs2_xattr_list_entries().\nS:U - The OOB/UAF is in the dinode buffer_head parsed by ocfs2_validate_inode_block() on the same host that mounted the volume and does not cross a VM, IOMMU, or guest-to-host boundary.\nC:H - ocfs2_xattr_list_entries() memcpy\u2019s xe_name_len bytes from header+xe_name_offset into the listxattr buffer, and ocfs2_xattr_ibody_get() memcpy\u2019s xe_value_size bytes from that same unvalidated offset into the getxattr buffer; the repro is a KASAN UAF read of size 2 in ocfs2_xattr_find_entry().\nI:H - The same unvalidated xe_name_offset/xe_value_size are a kernel UAF/OOB walk of the inline region; ocfs2_xa_block_wipe_namevalue() memmove\u2019s from header+min(xe_name_offset) with namevalue_size_xe() taken from on-disk xe_value_size when setxattr reuses that entry, a heap write primitive.\nA:H - The KASAN report is a use-after-free in ocfs2_xattr_find_entry() from getxattr; namevalue_size_xe() BUG_ON()s when a local inline entry has xe_value_size \u003e OCFS2_XATTR_INLINE_SIZE, and walking an out-of-range name/value offset can oops the node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:35.231Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3fd45b24879fa4885b66a582a6e47eda67f11310"
        },
        {
          "url": "https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"
        }
      ],
      "title": "ocfs2: validate inline xattrs during inode block validation",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90321",
    "datePublished": "2026-09-17T16:08:38.138Z",
    "dateReserved": "2026-09-11T19:38:34.802Z",
    "dateUpdated": "2026-09-18T17:54:35.231Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90321",
      "date": "2026-09-25",
      "epss": "0.00174",
      "percentile": "0.0604"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:45:38.000Z",
      "cve": "CVE-2026-90321",
      "id": "msrc_CVE-2026-90321",
      "initial_release_date": "2026-09-19T01:08:25.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: validate inline xattrs during inode block validation",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90321.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/inode.c",
                  "fs/ocfs2/xattr.c",
                  "fs/ocfs2/xattr.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "3fd45b24879fa4885b66a582a6e47eda67f11310",
                    "status": "affected",
                    "version": "cf1d6c763fbcb115263114302485ad17e7933d87",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8914a3330b72378136c2c02d6328a826f6abdad7",
                    "status": "affected",
                    "version": "cf1d6c763fbcb115263114302485ad17e7933d87",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/inode.c",
                  "fs/ocfs2/xattr.c",
                  "fs/ocfs2/xattr.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.28"
                  },
                  {
                    "lessThan": "2.6.28",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline xattrs during inode block validation\n\nPatch series \"ocfs2: validate xattr entry bounds\", v7.\n\nThis series validates OCFS2 xattr entry name/value bounds when xattr\nmetadata is read and validated, before getxattr() or listxattr() can walk\nout-of-range entry arrays or offsets from corrupted metadata.\n\n\nThis patch (of 2):\n\nocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk\nmetadata from it, but inline xattr metadata is still checked only in\noperation-specific consumers.  The existing ibody lookup helper validates\ninline header placement and entry count, but inode block validation does\nnot reject entry name/value bounds.\n\nAdd a flat xattr entry validator and call it from inode block validation\nfor inline xattrs.  Keep the operation paths on their existing\nheader/count lookup checks; the full entry bounds check now runs when the\ninode block is validated at read time.\n\nReject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or\nlistxattr() can walk past the inline storage.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170\nRead of size 2 at addr ffff8881242a2000 by task python3/529\nCall Trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  kasan_report+0xe0/0x110\n  ocfs2_xattr_find_entry+0x5a/0x170\n  ocfs2_xattr_get_nolock+0x20a/0x820\n  ocfs2_xattr_get+0x10c/0x1e0\n  __vfs_getxattr+0xe2/0x130\n  vfs_getxattr+0x185/0x1b0"
          }
        ],
        "id": "CVE-2026-90321",
        "lastModified": "2026-09-18T18:17:53.710",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:30.067",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3fd45b24879fa4885b66a582a6e47eda67f11310"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.