CVE-2026-80644: Linux Kernel OCFS2 Denial of Service Vulnerability

CVE-2026-80644 Overview

CVE-2026-80644 is a denial-of-service vulnerability in the Linux kernel's Oracle Cluster File System version 2 (OCFS2) implementation. A fuzzed or malformed OCFS2 filesystem image can corrupt the current slot journal dinode while a mount operation is still in progress. When the mount teardown path reaches ocfs2_journal_toggle_dirty() in fs/ocfs2/journal.c, a BUG_ON() assertion fires on the invalid dinode. This triggers a kernel panic instead of a clean mount failure. The regression was introduced by commit 10995aa2451a ("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks."), which converted a prior -EIO return path into an unconditional assertion.

Critical Impact
Mounting a crafted OCFS2 image triggers a kernel panic in the mount teardown path, resulting in host denial of service.

Affected Products

Linux kernel versions containing commit 10995aa2451a in the OCFS2 filesystem driver
Distributions shipping OCFS2 support prior to the backported fix commits
Systems that permit mounting untrusted OCFS2 filesystem images

Discovery Timeline

2026-08-28 - CVE CVE-2026-80644 published to NVD
2026-08-28 - Last updated in NVD database

Technical Details for CVE-2026-80644

Vulnerability Analysis

The defect resides in ocfs2_journal_toggle_dirty() at fs/ocfs2/journal.c:1034. Previously the function returned -EIO when journal->j_bh no longer contained a valid dinode. The startup and shutdown paths handled that error gracefully, allowing mount to fail without harming kernel stability. Commit 10995aa2451a replaced the runtime check with a BUG_ON() under the assumption that the journal dinode had already been validated earlier in the mount path.

That assumption does not hold when the on-disk image has been tampered with. If the current slot journal dinode is corrupted between the initial validation and the teardown call, the assertion fires. The result is an invalid opcode oops with the call chain ocfs2_journal_shutdown -> ocfs2_mount_volume -> ocfs2_fill_super -> path_mount. Any local user with rights to mount a filesystem, or any workflow that auto-mounts removable media, can trigger the crash.

Root Cause

The root cause is an over-strict invariant check. A recoverable I/O condition, specifically an invalidated journal dinode buffer head, was reclassified as a programming invariant enforced by BUG_ON(). Kernel guidance discourages BUG_ON() on data-driven conditions because attacker-controlled input can then convert a soft error into a panic. This is a kernel Null Pointer Dereference / assertion-based denial-of-service pattern rather than a memory-safety flaw.

Attack Vector

An attacker crafts a malicious OCFS2 image whose journal dinode passes initial validation but becomes structurally invalid by the time ocfs2_journal_shutdown() executes. Mounting the image, whether via mount, an automounter, or a hotplug event on removable media, drives the shutdown path when mount fails. The BUG_ON() fires, panicking the kernel and terminating the host. Exploitation requires the ability to supply a filesystem image and initiate a mount but does not require prior code execution or elevated remote access.

The fix replaces BUG_ON() with WARN_ON() and returns -EIO, restoring the original clean-failure behavior while preserving the diagnostic warning. See the upstream commits referenced in the Kernel Git Commit c0438198c28b and related backports for the exact patch.

Detection Methods for CVE-2026-80644

Indicators of Compromise

Kernel oops messages containing kernel BUG at fs/ocfs2/journal.c:1034 in dmesg or the system journal.
Unexpected host reboots or panics correlated with an OCFS2 mount attempt on removable or network-attached media.
ocfs2_journal_toggle_dirty frames appearing in crash dumps or pstore output following a mount operation.

Detection Strategies

Monitor kernel logs for OCFS2 validation errors immediately preceding a panic, particularly "invalid journal block" messages emitted before the assertion.
Audit mount syscalls (execve of mount, mount(2) via auditd rules) that specify -t ocfs2 and correlate with subsequent host unavailability.
Track loading of the ocfs2 kernel module on hosts that do not require it; unexpected loads warrant investigation.

Monitoring Recommendations

Ship /var/log/kern.log, journalctl -k, and kdump artifacts to a centralized logging tier for cross-host correlation.
Alert on repeated BUG_ON or WARN_ON events referencing fs/ocfs2/journal.c across the fleet.
Include OCFS2 kernel module presence in configuration baseline scans on servers that only require ext4, XFS, or btrfs.

How to Mitigate CVE-2026-80644

Immediate Actions Required

Apply the upstream OCFS2 patch or a distribution kernel update that includes the WARN_ON/-EIO fix for ocfs2_journal_toggle_dirty().
Restrict CAP_SYS_ADMIN and the ability to mount arbitrary filesystem images to trusted administrators only.
Disable automatic mounting of removable media on servers that do not require it.

Patch Information

The fix is delivered across multiple stable branches. Review the upstream commits linked in the NVD entry, including Kernel Git Commit 12c32a7350b, Kernel Git Commit 3852478d34c, Kernel Git Commit 5b33f99f3e4, Kernel Git Commit 86509c5296f, Kernel Git Commit a06eec15596e, Kernel Git Commit b460f8d01a12, Kernel Git Commit bf1d59cf2ac8, and Kernel Git Commit c0438198c28b. Rebase to the vendor kernel that carries the appropriate backport for your branch.

Workarounds

Blacklist the ocfs2 kernel module on hosts that do not use Oracle Cluster File System.
Prevent unprivileged users from invoking mount by removing user/users options from /etc/fstab and enforcing sudo policy.
Use signed or measured boot policies and udev rules to reject mounting untrusted block devices.

bash

# Blacklist OCFS2 on hosts that do not require it
echo 'blacklist ocfs2' | sudo tee /etc/modprobe.d/blacklist-ocfs2.conf
echo 'install ocfs2 /bin/true' | sudo tee -a /etc/modprobe.d/blacklist-ocfs2.conf
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep -i ocfs2