GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-80638 (GCVE-0-2026-80638)

Vulnerability from cvelistv5 – Published: 2026-08-28 06:48 – Updated: 2026-08-29 06:21
VLAI
Title
ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. [CAUSE] When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root back to leaf mode with a bulk memset on &rb->rf_records. rf_records sits in an anonymous union with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count, and is 0 for a single-level tree. With rl_count equal to 0, the memset writes past the 16-byte declared size of rf_records, which the fortify checker catches. [FIX] Replace the bulk memset on &rb->rf_records with a correctly-bounded memset on rl_recs[] alone, after setting rl_count to the correct value.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 2f26f58df041bbcf692730ff4d8ab0f250d9670d , < f5255516ec7add3a6d5d37853ad5a9a9ddb14305 (git)
Affected: 2f26f58df041bbcf692730ff4d8ab0f250d9670d , < 1ec3cca2d8b6b9ff6584ca626d4c8918bbf48d44 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.19
Unaffected: 0 , < 6.19 (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/refcounttree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5255516ec7add3a6d5d37853ad5a9a9ddb14305",
              "status": "affected",
              "version": "2f26f58df041bbcf692730ff4d8ab0f250d9670d",
              "versionType": "git"
            },
            {
              "lessThan": "1ec3cca2d8b6b9ff6584ca626d4c8918bbf48d44",
              "status": "affected",
              "version": "2f26f58df041bbcf692730ff4d8ab0f250d9670d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/refcounttree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.19"
            },
            {
              "lessThan": "6.19",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent\n\n[BUG]\nUnlinking a refcounted file whose refcount tree has leaf blocks\ntriggers a fortify panic due to an out-of-bounds write.\n\n[CAUSE]\nWhen the last leaf block is removed from a refcount tree,\nocfs2_remove_refcount_extent() converts the root back to leaf mode\nwith a bulk memset on \u0026rb-\u003erf_records. rf_records sits in an anonymous\nunion with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count,\nand is 0 for a single-level tree. With rl_count equal to 0, the memset\nwrites past the 16-byte declared size of rf_records, which the fortify\nchecker catches.\n\n[FIX]\nReplace the bulk memset on \u0026rb-\u003erf_records with a correctly-bounded\nmemset on rl_recs[] alone, after setting rl_count to the correct value."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - OCFS2 registers NFS export operations and is commonly NFS-exported on shared cluster storage; remote NFS SETATTR/truncate or REMOVE/unlink on refcounted files reaches ocfs2_decrease_refcount() and the vulnerable memset via kernel nfsd.\nAC:L - An attacker can deterministically create refcounted files with multi-block refcount trees via reflink/copy_file_range, then trigger removal of the last leaf through truncate or unlink; syzbot reproduced this reliably without races or victim-specific timing.\nPR:L - Only normal filesystem write permission on the target file or parent directory is required to truncate/unlink refcounted data; no real-root or init-namespace capabilities are needed beyond access to the mounted OCFS2 volume.\nUI:N - Exploitation requires only attacker-initiated filesystem operations (reflink setup, truncate, or unlink) on objects they can write; no additional end-user or administrator interaction beyond routine file access is needed.\nS:U - Impact is confined to kernel/filesystem integrity and availability on systems running OCFS2; it does not cross a VM, container, or IOMMU security boundary into another authority domain.\nC:H - The out-of-bounds memset corrupts refcount-tree metadata within the on-disk block image, which can misdirect subsequent metadata reads and expose stale or cross-file cluster data on shared cluster filesystems.\nI:H - This is an out-of-bounds write (FORTIFY reported a 384-byte write past a 16-byte declared rf_records object) that zeros arbitrary portions of the refcount root block, corrupting filesystem metadata and enabling further memory corruption primitives.\nA:H - The fortify-detected out-of-bounds write triggers a kernel WARNING/panic during refcount-tree cleanup, causing node crash or denial of service on OCFS2 cluster members processing the malicious truncate or unlink."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-29T06:21:38.111Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5255516ec7add3a6d5d37853ad5a9a9ddb14305"
        },
        {
          "url": "https://git.kernel.org/stable/c/1ec3cca2d8b6b9ff6584ca626d4c8918bbf48d44"
        }
      ],
      "title": "ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-80638",
    "datePublished": "2026-08-28T06:48:51.439Z",
    "dateReserved": "2026-08-26T14:34:25.777Z",
    "dateUpdated": "2026-08-29T06:21:38.111Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-80638",
      "date": "2026-09-17",
      "epss": "0.00348",
      "percentile": "0.28307"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-80638\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-28T08:16:48.720\",\"lastModified\":\"2026-08-29T07:16:47.790\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent\\n\\n[BUG]\\nUnlinking a refcounted file whose refcount tree has leaf blocks\\ntriggers a fortify panic due to an out-of-bounds write.\\n\\n[CAUSE]\\nWhen the last leaf block is removed from a refcount tree,\\nocfs2_remove_refcount_extent() converts the root back to leaf mode\\nwith a bulk memset on \u0026rb-\u003erf_records. rf_records sits in an anonymous\\nunion with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count,\\nand is 0 for a single-level tree. With rl_count equal to 0, the memset\\nwrites past the 16-byte declared size of rf_records, which the fortify\\nchecker catches.\\n\\n[FIX]\\nReplace the bulk memset on \u0026rb-\u003erf_records with a correctly-bounded\\nmemset on rl_recs[] alone, after setting rl_count to the correct value.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ocfs2/refcounttree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2f26f58df041bbcf692730ff4d8ab0f250d9670d\",\"lessThan\":\"f5255516ec7add3a6d5d37853ad5a9a9ddb14305\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f26f58df041bbcf692730ff4d8ab0f250d9670d\",\"lessThan\":\"1ec3cca2d8b6b9ff6584ca626d4c8918bbf48d44\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ocfs2/refcounttree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.19\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.19\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.5\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1ec3cca2d8b6b9ff6584ca626d4c8918bbf48d44\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f5255516ec7add3a6d5d37853ad5a9a9ddb14305\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-01T07:35:27+00:00",
      "cve": "CVE-2026-80638",
      "id": "CVE-2026-80638",
      "initial_release_date": "2026-08-28T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-80638.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-31T13:27:52Z",
      "cve": "CVE-2026-80638",
      "id": "CVE-2026-80638",
      "initial_release_date": "2026-08-28T16:35:33Z",
      "product_status:known_not_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-80638",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-80638.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.