CVE-2026-80638 Overview
CVE-2026-80638 is an out-of-bounds write vulnerability in the Linux kernel's Oracle Cluster File System 2 (OCFS2) implementation. The flaw resides in the ocfs2_remove_refcount_extent() function and is triggered when a user unlinks a refcounted file whose refcount tree has leaf blocks. A bulk memset on &rb->rf_records writes past the declared 16-byte size of the structure, which the kernel's fortify checker detects and reports as a panic. The condition is reachable by local users performing normal file operations on an OCFS2 volume, making the issue relevant for shared-storage cluster deployments that rely on OCFS2.
Critical Impact
A local user with write access to an OCFS2 volume can trigger a fortify-detected out-of-bounds write during file unlink, causing kernel panic and potential memory corruption on cluster nodes.
Affected Products
- Linux kernel builds with the OCFS2 filesystem enabled
- Distributions shipping vulnerable OCFS2 refcount tree handling prior to the upstream fix
- Cluster storage deployments using OCFS2 shared volumes
Discovery Timeline
- 2026-08-28 - CVE-2026-80638 published to NVD
- 2026-08-29 - Last updated in NVD database
Technical Details for CVE-2026-80638
Vulnerability Analysis
The bug lives in fs/ocfs2/refcounttree.c inside ocfs2_remove_refcount_extent(). When the last leaf block is removed from a refcount tree, the function converts the on-disk root back to leaf mode. It performs a bulk memset on &rb->rf_records to clear the record area. rf_records sits in an anonymous union with rf_list, and rf_list.l_tree_depth aliases rf_records.rl_count.
For a single-level tree, l_tree_depth is 0, so rl_count is also 0 at the moment of the clear. The memset length is computed from fields that expect a non-zero record count, causing the write to extend beyond the declared 16-byte size of rf_records. The kernel's CONFIG_FORTIFY_SOURCE runtime check identifies the overflow and panics the node.
Root Cause
The root cause is an aliasing mistake between two union members combined with an unchecked memset size. The code assumed rf_records had its own valid rl_count field, but because rl_count overlaps l_tree_depth, it was zero during the transition from extent mode to leaf mode. The upstream fix replaces the wide memset on &rb->rf_records with a correctly bounded memset on rl_recs[] only, applied after rl_count is set to its proper value.
Attack Vector
An attacker with local access and the ability to create, refcount, and unlink files on an OCFS2 volume can trigger the condition through ordinary filesystem operations. The panic denies service to all nodes that mount the affected clustered volume. The out-of-bounds write also corrupts adjacent kernel memory before fortify aborts, which raises the possibility of exploitation for privilege escalation on kernels compiled without fortify checks. No public proof-of-concept is currently available. See the kernel commit fixing the issue for technical details.
Detection Methods for CVE-2026-80638
Indicators of Compromise
- Kernel panic messages referencing fortify_panic or __write_overflow originating from ocfs2_remove_refcount_extent
- Unexpected node fencing or reboots on OCFS2 cluster members following unlink operations on refcounted files
- dmesg entries showing memory corruption warnings tied to the refcounttree.c code path
Detection Strategies
- Monitor kernel logs for OCFS2 stack traces containing ocfs2_remove_refcount_extent and fortify-source overflow reports.
- Correlate node crashes across the cluster with recent file unlink activity on reflinked or deduplicated files.
- Track kernel version inventory to identify hosts still running pre-patch OCFS2 code.
Monitoring Recommendations
- Forward /var/log/kern.log and journalctl -k output to a centralized logging platform for cluster-wide visibility.
- Alert on repeated OCFS2 module crashes or filesystem remount events across cluster nodes.
- Baseline expected unlink and reflink workloads to spot anomalous patterns that may indicate abuse.
How to Mitigate CVE-2026-80638
Immediate Actions Required
- Apply the upstream kernel patch or vendor backport that replaces the bulk memset with a bounded write on rl_recs[].
- Restrict local shell access on cluster nodes exporting OCFS2 volumes until patches are deployed.
- Audit which users and services can create and unlink files on OCFS2 mounts and reduce that set where feasible.
Patch Information
The fix is available in the mainline kernel via the commits 1ec3cca2d8b6 and f5255516ec7a. Distribution maintainers are backporting the change to supported stable kernel branches. Update to a kernel package that includes both commits and reboot each cluster node in a controlled rolling fashion.
Workarounds
- Unmount OCFS2 volumes on nodes that do not require them until patched kernels are installed.
- Disable or avoid reflink operations on OCFS2 to reduce the likelihood of leaf-block refcount tree layouts.
- Enforce strict filesystem permissions to prevent untrusted users from writing to OCFS2 mounts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
