CVE-2026-53041 - Vulnerability Details

- ocfs2: fix listxattr handling when the buffer is full

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix listxattr handling when the buffer is full

[BUG]
If an OCFS2 inode has both inline and block-based xattrs, listxattr()
can return a size larger than the caller's buffer when the inline names
consume that buffer exactly.

kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102
Call Trace:
__check_heap_object+0xe3/0x120 mm/slub.c:8243
check_heap_object mm/usercopy.c:196 [inline]
__check_object_size mm/usercopy.c:250 [inline]
__check_object_size+0x5c5/0x780 mm/usercopy.c:215
check_object_size include/linux/ucopysize.h:22 [inline]
check_copy_size include/linux/ucopysize.h:59 [inline]
copy_to_user include/linux/uaccess.h:219 [inline]
listxattr+0xb0/0x170 fs/xattr.c:926
filename_listxattr fs/xattr.c:958 [inline]
path_listxattrat+0x137/0x320 fs/xattr.c:988
__do_sys_listxattr fs/xattr.c:1001 [inline]
__se_sys_listxattr fs/xattr.c:998 [inline]
__x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998
...

[CAUSE]
Commit 936b8834366e ("ocfs2: Refactor xattr list and remove
ocfs2_xattr_handler().") replaced the old per-handler list accounting
with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect
probe mode.

That assumption stops being true once ocfs2_listxattr() finishes the
inline-xattr pass. If the inline names fill the caller buffer exactly,
the block-xattr pass runs with a non-NULL buffer and a remaining size of
zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps
counting block names, and returns a positive size larger than the
supplied buffer.

[FIX]
Detect probe mode by testing whether the destination buffer pointer is
NULL instead of whether the remaining size is zero.

That restores the pre-refactor behavior and matches the OCFS2 getxattr
helpers. Once the remaining buffer reaches zero while more names are
left, the block-xattr pass now returns -ERANGE instead of reporting a
size larger than the allocated list buffer.

Published: 2026-06-24

Score: 7.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s ocfs2 filesystem contains a flaw in the handling of extended attributes. When an inode carries both inline and block‑based xattrs, the listxattr() routine can report a size that exceeds the caller’s buffer if the inline names fill the buffer exactlyof‑bounds write and memory corruption (CWE‑787) as the kernel attempts to and a crash. The outcome is a kernel panic, effectively disabling the affected system and providing a local denial‑of‑service.

Affected Systems

All Linux kernel releases that implement ocfs2 and lack the fix introduced by commit 936b8834366e. The issue is not tied to a specific distribution; any kernel version without that commit is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates a high severity, while the EPSS score of < 1% shows a low but non‑zero exploitation probability. Despite its rarity, the impact is catastrophic—a kernel panic leads to complete loss of availability. The vulnerability is not listed in CISA KEV and the absence of a mitigation other than patching makes rapid remediation essential.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< a35a1c2b170b5b578b1b3fecb95694796552af9a
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< 2323084c17370304f49c84b354fe7b3edbb264fe
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< 6f702b00b8124c5d3525f19172934544826a114d
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< d919b905939eda93393e3572900ff70dbad2b47f
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< 46e66fefb83811958127bc9ad736983ec629d82b
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< 2685df8577a38d83b367c8cf52eda9dc286959ff
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< 50033ec1350fe68abdc63b950ced7ae57364b77a
`936b8834366ec05f2a6993f73afd8348cac9718e`	affected	< d12f558e6200b3f47dbef9331ed6d115d2410e59

Linux

affected

Version	Status	Constraints
`2.6.28`	affected	—
`0`	unaffected	< 2.6.28
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[936b8834366ec05f2a6993f73afd8348cac9718e,a35a1c2b170b5b578b1b3fecb95694796552af9a)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,2323084c17370304f49c84b354fe7b3edbb264fe)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,6f702b00b8124c5d3525f19172934544826a114d)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,d919b905939eda93393e3572900ff70dbad2b47f)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,46e66fefb83811958127bc9ad736983ec629d82b)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,2685df8577a38d83b367c8cf52eda9dc286959ff)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,50033ec1350fe68abdc63b950ced7ae57364b77a)`	affected	code_commit	—
`[936b8834366ec05f2a6993f73afd8348cac9718e,d12f558e6200b3f47dbef9331ed6d115d2410e59)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.28`	affected	semver	—
`[0,2.6.28)`	unaffected	semver	—
`[5.10.258,5.10.*]`	unaffected	semver	—
`[5.15.209,5.15.*]`	unaffected	semver	—
`[6.1.175,6.1.*]`	unaffected	semver	—
`[6.6.141,6.6.*]`	unaffected	semver	—
`[6.12.91,6.12.*]`	unaffected	semver	—
`[6.18.33,6.18.*]`	unaffected	semver	—
`[7.0.10,7.0.*]`	unaffected	semver	—
`[7.1,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply 936b8834366e or later to address the listxattr buffer overflow.
If an immediate kernel update is not feasible, restrict access to OCFS2 file system operations to trusted administrators or migrate critical data to an alternative file system that does not expose the failure.
Enable kernel crash monitoring and configure alerts so that any unexpected kernel panics can be detected and responded to promptly.

Generated by OpenCVE AI on June 28, 2026 at 13:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4664-1	linux security update
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe
https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff
https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b
https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a
https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d
https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a
https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59
https://git.kernel.org/stable/c/d919b905939eda93393e3572900ff70dbad2b47f
https://lore.kernel.org/linux-cve-announce/2026062457-CVE-2026-53041-bc7b@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53041
https://www.cve.org/CVERecord?id=CVE-2026-53041

History

Sun, 28 Jun 2026 08:00:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.1, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H'}`

Fri, 26 Jun 2026 05:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-120 CWE-125

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-787
References		https://lore.kernel.org/linux-cve-announce/2026062457-CVE-2026-53041-bc7b@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53041 https://www.cve.org/CVERecord?id=CVE-2026-53041

Wed, 24 Jun 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-120 CWE-125

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly. kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ... [CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode. That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer. [FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero. That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.
Title		ocfs2: fix listxattr handling when the buffer is full
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59 https://git.kernel.org/stable/c/d919b905939eda93393e3572900ff70dbad2b47f

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:29:47.501Z

Updated: 2026-06-28T06:38:23.107Z

Reserved: 2026-06-09T07:44:35.380Z

Link: CVE-2026-53041

Vulnrichment

No data.

NVD

No data.

Redhat

Severity :

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53041 - Bugzilla

OpenCVE Enrichment

Updated: 2026-06-28T13:45:06Z

Weaknesses

CWE-787
Out-of-bounds Write

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object