CVE-2026-53039: Linux OCFS2 Local Denial of Service via Unvalidated Group Add

Technical summary

CVE-2026-53039 is a use-before-validation bug in fs/ocfs2/resize.c where ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-supplied group block number prior to invoking ocfs2_verify_group_and_input(). The ocfs2_set_new_buffer_uptodate() function asserts that the block is not already cached, and it additionally uses INODE_CACHE(inode) instead of INODE_CACHE(main_bm_inode), causing a BUG_ON when the metadata cache state is inconsistent with the journal's expectations. The fix reorders validation before caching, ensures the correct inode cache context is used (main_bm_inode), and maintains proper buffer lifetime semantics across the validation, journaling, and cleanup paths.

Business impact

This vulnerability enables local denial of service attacks against systems running affected Linux kernels with OCFS2 support. An authenticated user can crash the kernel, disrupting cluster services and any applications relying on OCFS2 storage. While the CVSS score reflects the local-only nature of exploitation and lack of confidentiality or integrity impact, repeated crashes can degrade availability and complicate cluster operations.

Affected systems

The vulnerability affects the Linux kernel, specifically the OCFS2 (Oracle Cluster Filesystem 2) subsystem. It requires local system access and the ability to issue ioctl calls on an OCFS2 filesystem mount. Systems using OCFS2 for cluster storage or local filesystem operations are at risk; many standard Linux distributions compile OCFS2 as a loadable module.

Exploitability

Exploitation is straightforward for a local attacker: triggering the OCFS2_IOC_GROUP_ADD ioctl with an invalid group block number immediately causes a kernel panic. No special privileges beyond normal user access to an OCFS2 mount are required. The vulnerability is not known to be weaponized in public exploits, but the attack surface is low friction.

Remediation

Apply a kernel patch that implements the validation reordering: validate the on-disk group descriptor via ocfs2_verify_group_and_input() before calling ocfs2_set_new_buffer_uptodate(), and use INODE_CACHE(main_bm_inode) for consistency with journal operations. Verify the applied patch against your Linux distribution's kernel advisory or kernel.org for the specific version number.

Patch guidance

Check your Linux distribution's security advisories for a kernel update addressing CVE-2026-53039 in the OCFS2 subsystem. The fix involves reordering validation logic in ocfs2_group_add() to occur before any cache operations, and correcting the inode cache context. Rebuild and test the kernel in your environment before production deployment, particularly if you rely on OCFS2 for storage cluster operations.

Detection guidance

Monitor kernel logs for BUG_ON panics originating from fs/ocfs2/uptodate.c:509 or fs/ocfs2/resize.c:507. Audit ioctl call patterns targeting OCFS2_IOC_GROUP_ADD from unprivileged users. If your infrastructure does not use OCFS2, this vulnerability poses no risk. Systems with OCFS2 disabled or not loaded are unaffected.

Why prioritize this

Although CVSS 5.5 is moderate, prioritize patching if your infrastructure depends on OCFS2 for cluster or local storage. Local DoS vulnerabilities that crash the kernel warrant rapid remediation in production environments, particularly where cluster uptime is critical. If OCFS2 is not in use, deprioritize behind remote code execution or privilege escalation issues.

Risk score, explained

The CVSS 3.1 score of 5.5 (MEDIUM) reflects: local attack vector (AV:L) requiring direct system access, low attack complexity (AC:L) with no special conditions, low privilege requirement (PR:L) for an authenticated user, no user interaction (UI:N), unchanged scope (S:U), no confidentiality loss (C:N), no integrity loss (I:N), but high availability impact (A:H) via kernel panic. The score appropriately downweights the attack due to locality but emphasizes the severity of the denial of service effect.

Frequently asked questions