Description
In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

[BUG]
A direct write over unwritten extents can panic the kernel in
ocfs2_assure_trans_credits() when the journal aborts during DIO
completion. The crash is a general protection fault from a NULL pointer
dereference.

[CAUSE]
ocfs2_dio_end_io_write() loops over a direct write's unwritten extents,
marking each written under a single journal handle. If the journal
aborts (for example after an I/O error) while the extent tree is being
updated, the handle is left aborted with its transaction pointer
cleared. The extent merge treats that failure as not critical and
reports success, so the loop keeps using the handle.
ocfs2_assure_trans_credits() reads the handle's remaining credits
without first checking whether the handle is aborted, and that read
dereferences the cleared transaction pointer.

[FIX]
A journal abort is recorded in the handle itself, so callers are
expected to test the handle rather than rely on a returned error.
Make ocfs2_assure_trans_credits() do that, as the other ocfs2 journal
helpers already do, and return -EROFS when the handle is aborted.
Published: 2026-08-15
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The Linux kernel contains a flaw in OCFS2’s journaling code where a NULL pointer dereference can occur during a direct write operation when the journal aborts. The vulnerability manifests as a general protection fault that can crash the system. The weakness is a classic NULL pointer dereference, allowing an attacker or a faulty I/O condition to cause a kernel panic, disrupting availability of the entire machine.

Affected Systems

The defect affects any installation of the Linux kernel that utilizes the OCFS2 file system. It applies to all currently supported kernel releases until the patch is applied, regardless of distribution or distribution version, as the CNA list indicates Linux:Linux. Specific kernel versions are not enumerated, so any kernel containing the unpatched OCFS2 code is at risk.

Risk and Exploitability

This issue is a high‑impact issue because it leads to a kernel panic. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exact CVSS score is not supplied, but the semantics of a kernel crash imply a severe security impact. Likely attack vectors involve legitimate or malicious direct write operations to an OCFS2 volume, especially in the presence of I/O errors that trigger a journal abort. An attacker with the ability to trigger or modify such I/O on a node where OCFS2 is in use could intentionally bring the system down.

Generated by OpenCVE AI on August 15, 2026 at 09:14 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the patch commits referenced in the input links
  • If a kernel update is not immediately feasible, dismount or unconfigure any OCFS2 file systems and, if possible, disable the OCFS2 module to prevent the vulnerable code from executing
  • Regularly monitor system logs for “NULL pointer dereference” or “kernel panic” messages related to OCFS2 to detect unpatched activity

Generated by OpenCVE AI on August 15, 2026 at 09:14 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 15 Aug 2026 09:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-476

Sat, 15 Aug 2026 06:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits [BUG] A direct write over unwritten extents can panic the kernel in ocfs2_assure_trans_credits() when the journal aborts during DIO completion. The crash is a general protection fault from a NULL pointer dereference. [CAUSE] ocfs2_dio_end_io_write() loops over a direct write's unwritten extents, marking each written under a single journal handle. If the journal aborts (for example after an I/O error) while the extent tree is being updated, the handle is left aborted with its transaction pointer cleared. The extent merge treats that failure as not critical and reports success, so the loop keeps using the handle. ocfs2_assure_trans_credits() reads the handle's remaining credits without first checking whether the handle is aborted, and that read dereferences the cleared transaction pointer. [FIX] A journal abort is recorded in the handle itself, so callers are expected to test the handle rather than rely on a returned error. Make ocfs2_assure_trans_credits() do that, as the other ocfs2 journal helpers already do, and return -EROFS when the handle is aborted.
Title ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-15T05:53:31.157Z

Reserved: 2026-08-09T03:40:39.909Z

Link: CVE-2026-72163

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-15T06:21:34.217

Modified: 2026-08-15T06:21:34.217

Link: CVE-2026-72163

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-15T09:15:04Z

Weaknesses