CVE-2026-80638: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2removerefcountextent
[BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write.
[CAUSE] When the last leaf block is removed from a refcount tree, ocfs2removerefcountextent() converts the root back to leaf mode with a bulk memset on &rb->rfrecords. rfrecords sits in an anonymous union with rflist. rflist.ltreedepth aliases rfrecords.rlcount, and is 0 for a single-level tree. With rlcount equal to 0, the memset writes past the 16-byte declared size of rfrecords, which the fortify checker catches.
[FIX] Replace the bulk memset on &rb->rfrecords with a correctly-bounded memset on rlrecs[] alone, after setting rlcount to the correct value.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ocfs2_remove_refcount_extent(), replace the bulk memset on &rb->rf_records with a correctly bounded memset on rl_recs[] alone, after setting rl_count to the correct value.
Event History
Frequently Asked Questions
Which systems are exposed to the failure condition?
The condition applies to Linux kernel systems using OCFS2 where a refcounted file has a refcount tree containing leaf blocks. It is triggered when that file is unlinked and the final leaf block is removed from the refcount tree.
What symptom indicates that this issue has been encountered?
The described symptom is a fortify panic caused by an out-of-bounds write during unlinking. The affected path is ocfs2_remove_refcount_extent().
Is a particular OCFS2 tree state required?
Yes. The failure occurs when removing the last leaf block causes the refcount tree root to be converted back to leaf mode; in that state, the aliased record count is zero and the original bulk memset exceeds the declared rf_records size.