CVE-2026-53041: OCFS2 listxattr Buffer Overflow DoS in Linux Kernel

Technical summary

The vulnerability exists in the ocfs2_listxattr() and ocfs2_xattr_list_entry() functions within the OCFS2 filesystem driver. After a 2024 refactoring that replaced per-handler accounting with a unified list-entry function, the code retained logic that used buffer size == 0 as a proxy for detecting probe mode (when the caller only wants the required size, not actual data). This assumption breaks when inline xattrs precisely consume the provided buffer: the subsequent block-xattr iteration runs with a non-NULL buffer pointer but zero remaining size. The bounds check is skipped, the function continues counting attributes beyond the buffer limit, and returns a positive size that exceeds the allocated space. When copy_to_user attempts to transfer this oversized data, the kernel's usercopy protection detects the violation and terminates the process via BUG_ON().

Business impact

Systems relying on OCFS2 (primarily Oracle RAC deployments and clustered storage environments) face unplanned kernel panics during normal file attribute enumeration operations. Applications that recursively scan directory trees and read xattr metadata—such as backup tools, security scanning software, or filesystem auditing utilities—risk triggering crashes that degrade service availability. Recovery requires system restart, and repeated triggers can prevent services from remaining stable.

Affected systems

Linux kernels with OCFS2 filesystem support that have undergone the xattr handler refactoring (commit 936b8834366e and later). This primarily affects Oracle Linux distributions, Red Hat Enterprise Linux with cluster support enabled, and any distribution shipping an affected kernel version used in clustered or high-availability storage configurations. Non-OCFS2 filesystems and systems with OCFS2 disabled are unaffected.

Exploitability

The vulnerability requires local access and involves triggering listxattr() on a crafted or naturally occurring file with both inline and block-based xattrs. No authentication bypass, privilege escalation path, or remote exploitation is present—this is a local denial-of-service condition affecting process stability. An unprivileged user can trigger a crash on processes that read xattrs from files they can access, making it moderately easy to weaponize in multi-user systems but primarily affecting service continuity rather than data confidentiality or integrity.

Remediation

Apply kernel updates containing the fix that changes probe-mode detection from testing buffer size == 0 to testing buffer pointer == NULL. This restores pre-refactor behavior and ensures proper bounds checking. Vendors should backport the fix to affected stable kernel branches. Until patching, restrict listxattr access where possible and monitor system logs for usercopy_abort panics on OCFS2-using nodes.

Patch guidance

Verify availability of patched kernel versions from your Linux distribution (Red Hat, Oracle, Canonical, SUSE, etc.). The fix involves a logic change in ocfs2_listxattr() to pass a boolean indicating probe mode separately rather than inferring it from buffer size. Reboot to activate the patched kernel. No configuration changes are required; the fix is transparent to applications.

Detection guidance

Monitor kernel logs for 'kernel BUG at mm/usercopy.c:102' messages and usercopy_abort call traces involving listxattr and OCFS2 code paths. Enable kernel auditing for xattr syscalls and correlate frequency of such panics with user or application activity. On affected systems, apply systemd journal rate-limiting to prevent log flooding if crashes occur in rapid succession. Check /proc/cmdline or dmesg to confirm OCFS2 is in use.

Why prioritize this

Assigned HIGH severity due to reliable local crash capability affecting availability, combined with CVSS score of 7.1 reflecting high impact on confidentiality and availability. While not remotely exploitable or privilege-escalating, the crash potential in production clustered environments where OCFS2 is mission-critical makes rapid patching essential. Organizations running OCFS2 should treat this as urgent; others can defer.

Risk score, explained

CVSS 3.1 score of 7.1 reflects Attack Vector Local (cannot be exploited remotely), low Attack Complexity (straightforward trigger via listxattr), low Privileges Required (any user can call listxattr on accessible files), and high Availability impact (denial of service via kernel panic). Confidentiality and Integrity are not affected. The score appropriately captures the serious but localized nature of this defect.

Frequently asked questions