CVE-2026-80809: ocfs2: fix missing metadata reservation for large xattrs
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix missing metadata reservation for large xattrs
[BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block.
[CAUSE] ocfs2calcxattrsetneed() never reserves metadata blocks for a new xattr value's extent tree when the file already has an external xattr block. The notfound path leaves metaadd at zero, so metaac is NULL when ocfs2xattrextendallocation() runs.
A new value root has room for a single extent record. On a fragmented filesystem, the allocator cannot satisfy the xattr value in one contiguous run, so each non-contiguous run requires its own extent record. When the value root's extent list is full and metaac is NULL, ocfs2addclustersinbtree() returns RESTARTMETA, and ocfs2xattrextendallocation() hits BUGON(why == RESTARTMETA).
[FIX] The case where no xattr block exists yet already calls ocfs2extendmetaneeded(&defxv.xv.xrlist) to reserve value tree metadata. Add the same reservation to the case where an xattr block already exists, making the two cases consistent.
Replace the BUGON with a -ENOSPC return so that if RESTARTMETA is returned despite the reservation, the error propagates to userspace instead of panicking the kernel.
Affected Software
Event History
Frequently Asked Questions
What conditions are required to trigger the kernel panic?
An attacker or local process must be able to set a large extended attribute with lsetxattr() on an OCFS2 filesystem. The target file must already have an external xattr block, and filesystem fragmentation must prevent the new xattr value from being allocated as one contiguous extent.
Is a filesystem without an existing external xattr block affected by this specific failure path?
The description indicates that the no-existing-xattr-block case already reserves metadata for the value extent tree. The missing reservation occurs when an external xattr block already exists.
What happens when the issue is triggered?
The kernel panics when the xattr value needs more extent records than its initial root can hold and no metadata allocation context was reserved. The fix also replaces the BUG_ON handling for this condition with an error return.