CVE-2026-80638

Received Received - Intake

Out-of-Bounds Write in Linux Kernel OCFS2

Publication date: 2026-08-28

Last updated on: 2026-08-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. [CAUSE] When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root back to leaf mode with a bulk memset on &rb->rf_records. rf_records sits in an anonymous union with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count, and is 0 for a single-level tree. With rl_count equal to 0, the memset writes past the 16-byte declared size of rf_records, which the fortify checker catches. [FIX] Replace the bulk memset on &rb->rf_records with a correctly-bounded memset on rl_recs[] alone, after setting rl_count to the correct value.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-28

Last Modified

2026-08-29

Generated

2026-09-17

AI Q&A

2026-08-28

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80638

EUVD

EUVD-2026-67514

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where unlinking a refcounted file with a specific refcount tree structure triggers an out-of-bounds write. The bug occurs in the ocfs2_remove_refcount_extent function when removing the last leaf block from a refcount tree. The root cause is a bulk memset operation that writes past the allocated memory due to incorrect handling of a union field.

Detection Guidance

This vulnerability is specific to the Linux kernel's OCFS2 filesystem and requires kernel-level detection. Check kernel logs for fortify panic messages or out-of-bounds write errors related to ocfs2. Use commands like dmesg | grep -i fortify or dmesg | grep -i ocfs2 to inspect logs. Ensure your kernel version is updated to a patched release.

Impact Analysis

This vulnerability could lead to system crashes, data corruption, or potential privilege escalation if exploited. It specifically affects systems using the OCFS2 file system with refcounted files. An attacker with local access might trigger the flaw to cause denial-of-service or execute arbitrary code.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's ocfs2 file system, which could lead to memory corruption or crashes. Such issues may impact compliance with standards like GDPR or HIPAA by potentially exposing or corrupting sensitive data, but the specific compliance impact depends on system configuration and usage.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for CVE-2026-80638. Avoid unlinking refcounted files on OCFS2 filesystems until patched. Monitor kernel logs for fortify panics or out-of-bounds writes as indicators of exploitation.

Hi! I’m here to help you understand CVE-2026-80638. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70