CVE-2026-90320 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate external xattr entries when reading metadata
ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block. Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check.
Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time. The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target.
Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets.
Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630 Call Trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 kasan_report+0xe0/0x110 ocfs2_xattr_list_entries+0xd7/0x190 ocfs2_listxattr+0x3f6/0x610 listxattr+0x90/0xe0 path_listxattrat+0xed/0x220 do_syscall_64+0x115/0x6a0 entry_SYSCALL_64_after_hwframe+0x77/0x7f
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Open Cluster File System version 2, commonly referred to as ocfs2 within the Linux kernel ecosystem, contains a critical input validation deficiency in its handling of extended attribute metadata. Extended attributes allow users and applications to associate additional data with files beyond standard file content, such as security labels or application-specific tags. The vulnerability stems from an incomplete boundary check during the reading of external xattr blocks. While the function ocfs2_validate_xattr_block() performs initial checks on the block header before passing control to higher-level consumers, it fails to verify that non-indexed blocks have entry counts and offsets that remain within the allocated memory boundaries of the block itself. Similarly, indexed buckets are processed through error correction code mechanisms but lack specific validation ensuring that the array of entries stays bounded by the first bucket block or that name and value offsets point to valid locations within their target bucket blocks. This oversight allows corrupted or maliciously crafted external xattr metadata to bypass initial integrity checks and reach system calls responsible for listing or retrieving attributes, specifically listxattr() and getxattr().
The operational impact of this flaw is severe, manifesting as a use-after-free condition that can lead to kernel crashes or potential privilege escalation. When the kernel attempts to walk through entry arrays with out-of-range offsets due to missing validation, it accesses memory locations that may have already been freed or are otherwise invalid. This behavior was reproduced in reports showing a KASAN (Kernel Address Sanitizer) use-after-free error occurring within ocfs2_xattr_list_entries. The call trace indicates the fault originates when processing attributes via listxattr and path_listxattrat, ultimately triggering do_syscall_64. Such memory corruption vulnerabilities compromise system stability by causing kernel panics or BUG reports, effectively resulting in a denial of service for systems relying on ocfs2 storage. In more sophisticated attack scenarios, an attacker with the ability to write corrupted metadata to an ocfs2 volume could exploit this out-of-bounds read to leak sensitive kernel memory contents or potentially influence control flow if adjacent heap structures are manipulated, aligning with CWE-125 Out-of-bounds Read and CWE-416 Use After Free.
To mitigate this vulnerability, the Linux kernel maintainers have implemented stricter validation logic at metadata read time. For non-indexed external xattr blocks, a flat entry validator is now employed to ensure all entries fit within the block limits before they are exposed to user-space consumers. For indexed buckets, a bucket-specific validator has been introduced that enforces bounds on the entry array relative to the first bucket block and verifies that name and value offsets correspond correctly to their target bucket blocks. These changes effectively reject corrupted metadata early in the processing pipeline, preventing invalid pointers from being dereferenced by listxattr or getxattr operations. System administrators should ensure they are running kernel versions where this patch is applied, as unpatched systems remain susceptible to crashes and potential exploitation via crafted ocfs2 volumes. This fix aligns with ATT&CK technique T1083 File and Directory Discovery, as the vulnerability involves improper handling of file system metadata structures that could be abused for reconnaissance or further exploitation within a compromised environment.