{"id":"CVE-2026-90321","revision":"72d82064c443451cbd00e490d72f4bca","records":[{"revision":"72d82064c443451cbd00e490d72f4bca","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90321","aliases":[],"title":"ocfs2: validate inline xattrs during inode block validation","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate inline xattrs during inode block validation\n\nPatch series \"ocfs2: validate xattr entry bounds\", v7.\n\nThis series validates OCFS2 xattr entry name/value bounds when xattr\nmetadata is read and validated, before getxattr() or listxattr() can walk\nout-of-range entry arrays or offsets from corrupted metadata.\n\n\nThis patch (of 2):\n\nocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk\nmetadata from it, but inline xattr metadata is still checked only in\noperation-specific consumers.  The existing ibody lookup helper validates\ninline header placement and entry count, but inode block validation does\nnot reject entry name/value bounds.\n\nAdd a flat xattr entry validator and call it from inode block validation\nfor inline xattrs.  Keep the operation paths on their existing\nheader/count lookup checks; the full entry bounds check now runs when the\ninode block is validated at read time.\n\nReject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or\nlistxattr() can walk past the inline storage.\n\nValidation reproduced this kernel report:\nBUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170\nRead of size 2 at addr ffff8881242a2000 by task python3/529\nCall Trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  kasan_report+0xe0/0x110\n  ocfs2_xattr_find_entry+0x5a/0x170\n  ocfs2_xattr_get_nolock+0x20a/0x820\n  ocfs2_xattr_get+0x10c/0x1e0\n  __vfs_getxattr+0xe2/0x130\n  vfs_getxattr+0x185/0x1b0","state":0,"publishedAt":"2026-09-17T16:08:38.138+00:00","modifiedAt":"2026-10-21T12:50:56.779+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ocfs2/inode.c\",\n                        \"fs/ocfs2/xattr.c\",\n                        \"fs/ocfs2/xattr.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"cf1d6c763fbcb115263114302485ad17e7933d87\",\n                            \"lessThan\": \"7dec19f6bafe4e1503007141c9f5eb7eb10e5578\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cf1d6c763fbcb115263114302485ad17e7933d87\",\n                            \"lessThan\": \"8138d06e7a1d9a0b0481dc015c67b34e8bb60a58\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cf1d6c763fbcb115263114302485ad17e7933d87\",\n                            \"lessThan\": \"3fd45b24879fa4885b66a582a6e47eda67f11310\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"cf1d6c763fbcb115263114302485ad17e7933d87\",\n                            \"lessThan\": \"8914a3330b72378136c2c02d6328a826f6abdad7\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/ocfs2/inode.c\",\n                        \"fs/ocfs2/xattr.c\",\n                        \"fs/ocfs2/xattr.h\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"2.6.28\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"2.6.28\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.160\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.114\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/7dec19f6bafe4e1503007141c9f5eb7eb10e5578","https://git.kernel.org/stable/c/8138d06e7a1d9a0b0481dc015c67b34e8bb60a58","https://git.kernel.org/stable/c/3fd45b24879fa4885b66a582a6e47eda67f11310","https://git.kernel.org/stable/c/8914a3330b72378136c2c02d6328a826f6abdad7"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90321","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90321","identifiers":["CVE-2026-90321"]},"retained":false,"historicalAffected":[]}],"coverage":[]}