UBUNTU-CVE-2026-90321: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline xattrs during inode block validation Patch series "ocfs2: validate xattr entry bounds", v7. This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxattr() or listxattr() can walk out-of-range entry arrays or offsets from corrupted metadata. This patch (of 2): ocfs2validateinodeblock() verifies a dinode before OCFS2 users walk metadata from it, but inline xattr metadata is still checked only in operation-specific consumers. The existing ibody lookup helper validates inline header placement and entry count, but inode block validation does not reject entry name/value bounds. Add a flat xattr entry validator and call it from inode block validation for inline xattrs. Keep the operation paths on their existing header/count lookup checks; the full entry bounds check now runs when the inode block is validated at read time. Reject corrupted inline xattr metadata before ocfs2xattribodyget() or listxattr() can walk past the inline storage. Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2xattrfindentry+0x5a/0x170 Read of size 2 at addr ffff8881242a2000 by task python3/529 Call Trace: dumpstacklvl+0x66/0xa0 printreport+0xce/0x630 kasanreport+0xe0/0x110 ocfs2xattrfindentry+0x5a/0x170 ocfs2xattrgetnolock+0x20a/0x820 ocfs2xattrget+0x10c/0x1e0 vfsgetxattr+0xe2/0x130 vfsgetxattr+0x185/0x1b0