CVE-2026-46080: Linux Kernel OCFS2 DOS Vulnerability

CVE-2026-46080 Overview

CVE-2026-46080 is a Linux kernel vulnerability in the Oracle Cluster File System version 2 (ocfs2) subsystem. During direct I/O (DIO) write completion, the ocfs2_dio_end_io_write() function could exhaust the Journaling Block Device 2 (JBD2) credit limit when handling extent operations. The issue surfaces as a kernel warning: JBD2: kworker/6:2 wants too many credits credits:5450 rsv_credits:0 max:5449. A secondary correctness issue allowed stale blocks beyond end-of-file (EOF) if a crash occurred mid-update, because ocfs2_del_inode_from_orphan() ran before the extent tree update completed. The upstream fix splits transactions into batches and reorders orphan list removal.

Critical Impact
The flaw can trigger JBD2 journal warnings, abort transactions, and leave stale blocks beyond EOF after a crash, risking filesystem inconsistency on ocfs2 volumes performing direct I/O writes.

Affected Products

Linux kernel ocfs2 filesystem (mainline stable branches prior to the referenced fix commits)
Distributions shipping ocfs2 with affected kernel versions
Systems mounting ocfs2 volumes and using direct I/O writes

Discovery Timeline

2026-05-27 - CVE-2026-46080 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-46080

Vulnerability Analysis

The bug lies in how ocfs2_dio_end_io_write() finalizes direct I/O writes. The completion path walks pending extents and calls ocfs2_mark_extent_written(), which descends into ocfs2_change_extent_flag(), ocfs2_split_extent(), and ocfs2_try_to_merge_extent(). Each step reserves journal credits via ocfs2_extend_rotate_transaction() and ocfs2_extend_trans(). When many extents require processing in a single handle, the cumulative credit request exceeds the journal maximum, triggering start_this_handle() to warn that the caller wants more credits than allowed. This is a kernel filesystem reliability and integrity issue [CWE-400]-class resource exhaustion combined with an ordering defect in metadata updates.

Root Cause

The DIO completion handler attempted to perform all extent updates within a single JBD2 transaction. Each ocfs2_split_extent() and merge operation accumulates journal credits, and large extent lists overflow the per-transaction maximum. Separately, ocfs2_del_inode_from_orphan() was invoked before the extent tree updates were durably committed. A crash between these steps leaves the inode off the orphan list while extents beyond EOF remain unreclaimed, producing stale blocks.

Attack Vector

The issue is reachable through normal direct I/O write workloads on ocfs2 volumes that produce many unwritten extents requiring conversion at completion time. No remote network vector is documented. Triggering the warning requires local filesystem activity on an ocfs2 mount. The published NVD entry does not assign a CVSS vector or known exploit, and the affected attack surface is limited to systems running ocfs2.

The vulnerability manifests during extent state conversion at I/O completion. See the Linux Kernel Commit 069c3fb and Linux Kernel Commit ea5bb1d for the patch details.

Detection Methods for CVE-2026-46080

Indicators of Compromise

Kernel log messages of the form JBD2: <task> wants too many credits credits:<N> rsv_credits:0 max:<M> originating from ocfs2 worker threads.
Stack traces in dmesg containing ocfs2_dio_end_io_write, ocfs2_mark_extent_written, ocfs2_split_extent, and jbd2__journal_restart.
Post-crash fsck.ocfs2 reports of stale blocks beyond EOF or inodes incorrectly removed from the orphan list.

Detection Strategies

Monitor kernel ring buffer and syslog for JBD2 credit-exhaustion warnings on ocfs2 mounts.
Compare running kernel build identifiers against the fixed stable commits listed in the NVD references.
Run periodic fsck.ocfs2 checks after unclean shutdowns to identify orphan-list and EOF inconsistencies.

Monitoring Recommendations

Forward dmesg/journald output to a central log platform and alert on JBD2 and ocfs2 warning patterns.
Track kernel package versions across the fleet to ensure ocfs2 nodes receive stable updates containing the fix.
Capture filesystem health telemetry (mount errors, journal aborts, remount-read-only events) from ocfs2 cluster nodes.

How to Mitigate CVE-2026-46080

Immediate Actions Required

Inventory all systems mounting ocfs2 volumes and identify those running unpatched kernels.
Apply the upstream stable kernel updates that include the fix commits referenced in the NVD entry.
Schedule a maintenance window to reboot into the patched kernel on affected cluster nodes.

Patch Information

The fix is distributed across the following upstream commits: Linux Kernel Commit 069c3fb, Linux Kernel Commit 3c636a3, Linux Kernel Commit 886f97f, Linux Kernel Commit d647c5b, and Linux Kernel Commit ea5bb1d. The patch splits transactions in ocfs2_dio_end_io_write() into batches and relocates ocfs2_del_inode_from_orphan() so that orphan removal occurs only after extent tree updates succeed.

Workarounds

Reduce direct I/O write sizes and concurrency on ocfs2 mounts to lower the number of extents processed per completion.
Prefer buffered I/O on workloads that consistently trigger the JBD2 credit warning until patches are applied.
Increase journal size with tunefs.ocfs2 where supported to widen the credit ceiling, recognizing this is a partial mitigation only.

bash

# Verify kernel version and check ocfs2 mounts
uname -r
mount -t ocfs2

# Inspect kernel log for JBD2 credit warnings
dmesg | grep -E 'JBD2|ocfs2_dio_end_io_write'

# Run a consistency check after unmounting (offline)
umount /mnt/ocfs2-volume
fsck.ocfs2 -fy /dev/<ocfs2-device>