CVE-2026-80809
Received Received - Intake

Buffer Overflow in OCFS2 Filesystem

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix missing metadata reservation for large xattrs [BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block. [CAUSE] ocfs2_calc_xattr_set_need() never reserves metadata blocks for a new xattr value's extent tree when the file already has an external xattr block. The not_found path leaves meta_add at zero, so meta_ac is NULL when ocfs2_xattr_extend_allocation() runs. A new value root has room for a single extent record. On a fragmented filesystem, the allocator cannot satisfy the xattr value in one contiguous run, so each non-contiguous run requires its own extent record. When the value root's extent list is full and meta_ac is NULL, ocfs2_add_clusters_in_btree() returns RESTART_META, and ocfs2_xattr_extend_allocation() hits BUG_ON(why == RESTART_META). [FIX] The case where no xattr block exists yet already calls ocfs2_extend_meta_needed(&def_xv.xv.xr_list) to reserve value tree metadata. Add the same reservation to the case where an xattr block already exists, making the two cases consistent. Replace the BUG_ON with a -ENOSPC return so that if RESTART_META is returned despite the reservation, the error propagates to userspace instead of panicking the kernel.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-80809
EUVD
EUVD-2026-71244

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a kernel panic when setting a large extended attribute (xattr) on a fragmented filesystem with an existing external xattr block. The issue occurs because metadata blocks for the new xattr value's extent tree are not reserved, leading to a failure in allocation and triggering a BUG_ON condition.

Detection Guidance

This vulnerability is specific to the Linux kernel's OCFS2 filesystem and may cause kernel panics when setting large extended attributes on fragmented filesystems. Detection requires checking kernel logs for panic messages or filesystem errors related to OCFS2 and xattr operations. No direct commands are provided in the context, but monitoring dmesg or system logs for OCFS2-related errors may help identify exploitation attempts.

Impact Analysis

If exploited, this vulnerability could cause the Linux kernel to crash (panic), resulting in system instability or denial of service. Users may experience unexpected system reboots or crashes when performing operations involving large xattr values on fragmented filesystems.

Mitigation Strategies

Apply the kernel patch that resolves this issue by ensuring metadata reservations for xattr operations. Update to a patched kernel version where the fix for ocfs2_calc_xattr_set_need() has been implemented. Avoid using large xattr values on fragmented OCFS2 filesystems until the patch is applied.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-80809. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart