CVE-2026-90320: ocfs2: validate external xattr entries when reading metadata
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate external xattr entries when reading metadata
ocfs2validatexattrblock() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xhcount and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check.
Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time. The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target.
Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets.
Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2xattrlistentries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2xattrlis/630 Call Trace: dumpstacklvl+0x66/0xa0 printreport+0xce/0x630 kasanreport+0xe0/0x110 ocfs2xattrlistentries+0xd7/0x190 ocfs2listxattr+0x3f6/0x610 listxattr+0x90/0xe0 pathlistxattrat+0xed/0x220 dosyscall64+0x115/0x6a0 entrySYSCALL64afterhwframe+0x77/0x7f
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Reject corrupted external xattr metadata before calling listxattr() or getxattr(); ensure ocfs2_listxattr()/getxattr() validates external xattr entries when reading metadata (use flat xattr entry validator for non-indexed external xattr blocks and a bucket-specific validator for indexed buckets at metadata read).
ocfs2 (external xattr metadata handling) xattr block validation = enabled
Event History
Frequently Asked Questions
What conditions are required to trigger the issue?
The system must read corrupted external OCFS2 extended-attribute metadata. The vulnerable paths are reached when listxattr() or getxattr() processes non-indexed external xattr blocks or indexed xattr buckets whose entry arrays or name/value offsets are out of bounds.
What operation may expose an affected system?
Listing or retrieving extended attributes on an OCFS2 filesystem can reach the affected metadata parsing paths. The reported failure occurred in ocfs2_xattr_list_entries during a listxattr operation.
What does the available fix do?
The fix validates external xattr entries when metadata is read, before higher-level xattr consumers process them. It applies flat entry validation to non-indexed blocks and bucket-specific validation to indexed buckets, rejecting invalid entry bounds and name/value offsets.