CVE-2026-80644: ocfs2: don't BUG_ON an invalid journal dinode
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: don't BUGON an invalid journal dinode
[BUG] A fuzzed OCFS2 image can corrupt the current slot journal dinode while mount is still in progress. The mount path first reports the invalid journal block and then crashes in shutdown:
kernel BUG at fs/ocfs2/journal.c:1034! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2journaltoggledirty+0x2d6/0x340 fs/ocfs2/journal.c:1034 Call Trace: ocfs2journalshutdown+0x414/0xc30 fs/ocfs2/journal.c:1116 ocfs2mountvolume fs/ocfs2/super.c:1785 [inline] ocfs2fillsuper+0x30a9/0x3cd0 fs/ocfs2/super.c:1083 gettreebdevflags+0x38b/0x640 fs/super.c:1698 gettreebdev+0x24/0x40 fs/super.c:1721 ocfs2gettree+0x21/0x30 fs/ocfs2/super.c:1184 vfsgettree+0x9a/0x370 fs/super.c:1758 fcmount fs/namespace.c:1199 [inline] donewmountfc fs/namespace.c:3642 [inline] donewmount fs/namespace.c:3718 [inline] pathmount+0x5b8/0x1ea0 fs/namespace.c:4028 domount fs/namespace.c:4041 [inline] dosysmount fs/namespace.c:4229 [inline] sesysmount fs/namespace.c:4206 [inline] x64sysmount+0x282/0x320 fs/namespace.c:4206 ...
[CAUSE] ocfs2journaltoggledirty() used to return -EIO when journal->jbh no longer contained a valid dinode, because the startup and shutdown paths already handled that failure. Commit 10995aa2451a ("ocfs2: Morph the haphazard OCFS2ISVALIDDINODE() checks.") changed the check to a BUGON() under the assumption that the journal dinode had already been validated. That turns an unexpected invalid journal dinode during mount teardown into a kernel crash instead of a normal mount failure.
[FIX] Replace the BUGON() with WARNON() and return -EIO. This keeps the invariant warning for debugging, but restores the original behavior of failing startup or shutdown cleanly instead of panicking the kernel.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In ocfs2_journal_toggle_dirty (fs/ocfs2/journal.c:1034), replace the BUG_ON() with WARN_ON() and ensure the function returns -EIO instead of triggering a kernel BUG/panic when the journal dinode is invalid.
Linux kernel OCFS2 (fs/ocfs2/journal.c) BUG_ON() -> WARN_ON() behavior in ocfs2_journal_toggle_dirty = Replace BUG_ON() with WARN_ON() and return -EIO
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems that mount OCFS2 filesystem images are exposed when the image contains a corrupted current-slot journal dinode. The reported trigger is a fuzzed OCFS2 image during mount.
What does an attacker need to do to trigger the failure?
They need to cause the system to mount a malformed OCFS2 image with an invalid journal dinode. The failure occurs while the mount is still in progress and reaches journal shutdown handling.
What can be done before a fix is applied?
Avoid mounting untrusted, fuzzed, or otherwise suspect OCFS2 filesystem images. Restrict who can provide images or initiate mounts on affected systems.
How can I tell whether this has occurred?
The mount path reports an invalid journal block and then crashes with a kernel BUG in fs/ocfs2/journal.c:1034, in ocfs2_journal_toggle_dirty(). The stack trace includes ocfs2_journal_shutdown and OCFS2 mount functions.