CVE-2026-53041 Overview
CVE-2026-53041 is a Linux kernel vulnerability in the Oracle Cluster File System version 2 (OCFS2) extended attribute (xattr) handling code. The flaw triggers a kernel BUG in mm/usercopy.c when listxattr() returns a buffer size larger than the caller's allocated buffer. The condition arises when an OCFS2 inode stores both inline and block-based xattrs, and the inline names consume the user buffer exactly. The kernel's hardened usercopy check then aborts with an invalid opcode exception.
Critical Impact
Local users can trigger a kernel panic via listxattr() on a crafted OCFS2 filesystem, resulting in denial of service on systems mounting OCFS2 volumes.
Affected Products
- Linux kernel versions containing commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().")
- Distributions shipping OCFS2 support with the refactored xattr listing code
- Stable kernel branches prior to backport of the fix commits
Discovery Timeline
- 2026-06-24 - CVE-2026-53041 published to NVD
- 2026-06-24 - Last updated in NVD database
Technical Details for CVE-2026-53041
Vulnerability Analysis
The vulnerability resides in ocfs2_xattr_list_entry() within the OCFS2 filesystem implementation. OCFS2 stores extended attributes in two locations: inline within the inode, and in dedicated xattr blocks. The ocfs2_listxattr() function processes both regions sequentially when serving a listxattr() syscall.
The refactor introduced by commit 936b8834366e consolidated per-handler list accounting into ocfs2_xattr_list_entry(). The new helper uses size == 0 to detect probe mode, where the caller passes a NULL buffer to query the required size. This assumption breaks when the inline xattr pass exactly fills the caller's buffer, leaving zero remaining space while the buffer pointer is still non-NULL.
When the block-xattr pass executes with a non-NULL buffer and zero remaining size, the bounds check is skipped. The function continues appending name lengths to the running total and returns a size larger than the caller supplied. The subsequent copy_to_user() in fs/xattr.c:926 then triggers the hardened usercopy check, calling usercopy_abort() and crashing the kernel.
Root Cause
The root cause is incorrect probe-mode detection. The code conflates two distinct states: a NULL output buffer (probe mode) and a full buffer with zero remaining capacity (legitimate overflow condition). The latter must return -ERANGE rather than continue counting.
Attack Vector
A local user with the ability to create extended attributes on an OCFS2 inode can craft a scenario where inline names exactly fill a given list buffer. Calling listxattr() with that buffer size triggers the panic. The vulnerability requires local access and an OCFS2 volume but does not require elevated privileges.
No verified public exploitation code is available. The vulnerability is described in upstream commit messages referenced under technical references.
Detection Methods for CVE-2026-53041
Indicators of Compromise
- Kernel panic messages referencing usercopy_abort+0xb7/0xd0 at mm/usercopy.c:102
- Crash stack traces containing listxattr+0xb0/0x170 and __check_object_size
- Repeated invalid opcode: 0000 Oops entries on hosts mounting OCFS2 volumes
- System logs showing process termination during xattr enumeration on OCFS2 paths
Detection Strategies
- Monitor dmesg and /var/log/kern.log for hardened usercopy abort traces tied to listxattr
- Audit running kernel versions against the upstream fix commits listed in references
- Inventory hosts mounting OCFS2 filesystems and prioritize them for patch validation
- Correlate unexpected node fencing events in OCFS2 clusters with xattr-related crash signatures
Monitoring Recommendations
- Forward kernel logs to a central log aggregator and alert on usercopy_abort strings
- Track listxattr syscall failure rates per host to surface anomalous probing
- Review process accounting on OCFS2-backed shared storage for unusual xattr enumeration patterns
How to Mitigate CVE-2026-53041
Immediate Actions Required
- Apply the upstream stable kernel patches referenced in the Linux kernel stable tree
- Rebuild or update distribution kernels to versions that include the OCFS2 listxattr fix
- Restrict local shell access on systems exporting OCFS2 volumes until patches are deployed
- Validate cluster failover behavior after patching to confirm OCFS2 nodes remain stable
Patch Information
The fix changes probe-mode detection in ocfs2_xattr_list_entry() to test whether the destination buffer pointer is NULL instead of whether the remaining size is zero. This restores the pre-refactor semantics and aligns with the OCFS2 getxattr helpers. When the remaining buffer reaches zero with more names to list, the function now returns -ERANGE. Patches are available across multiple stable branches via the kernel.org stable tree and additional commits including 2685df85, 46e66fef, 50033ec1, 6f702b00, a35a1c2b, and d12f558e.
Workarounds
- Unmount OCFS2 filesystems on hosts where patching cannot be performed immediately
- Limit user accounts permitted to create or enumerate extended attributes on OCFS2 paths
- Disable extended attribute usage on OCFS2 volumes if operational requirements allow
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
