CVE-2026-80809 Overview
CVE-2026-80809 is a Linux kernel vulnerability in the Oracle Cluster File System version 2 (ocfs2) subsystem. The flaw resides in the extended attribute (xattr) handling code, specifically in ocfs2_calc_xattr_set_need(). When a user invokes lsetxattr() to set a large xattr value on a fragmented filesystem where the file already has an external xattr block, the kernel fails to reserve required metadata blocks. The resulting BUG_ON triggers a kernel panic, producing a local denial-of-service condition on affected systems.
Critical Impact
A local unprivileged user with write access to a file on a fragmented ocfs2 volume can panic the kernel by setting a large extended attribute.
Affected Products
- Linux kernel with ocfs2 filesystem support enabled
- Distributions shipping vulnerable ocfs2 module versions prior to the referenced stable commits
- Systems mounting Oracle Cluster File System version 2 volumes
Discovery Timeline
- 2026-09-04 - CVE-2026-80809 published to NVD
- 2026-09-04 - Last updated in NVD database
Technical Details for CVE-2026-80809
Vulnerability Analysis
The vulnerability lives in the ocfs2 extended attribute allocation path. The function ocfs2_calc_xattr_set_need() calculates how many metadata blocks the operation requires. When a file already has an external xattr block, the not_found code path leaves meta_add at zero. This makes meta_ac NULL when ocfs2_xattr_extend_allocation() later executes.
A freshly created value root can hold a single extent record. On a fragmented filesystem, the block allocator cannot place the xattr value into one contiguous run. Each non-contiguous extent then consumes its own extent record. Once the value root's extent list fills, ocfs2_add_clusters_in_btree() returns RESTART_META to request additional metadata. With meta_ac NULL, ocfs2_xattr_extend_allocation() hits BUG_ON(why == RESTART_META) and panics the kernel.
Root Cause
The root cause is inconsistent metadata reservation logic between two code paths [CWE-noinfo]. The path that handles files without any existing xattr block correctly calls ocfs2_extend_meta_needed(&def_xv.xv.xr_list) to reserve value tree metadata. The path that handles files with an existing external xattr block never performs this reservation. The BUG_ON assertion also converts a recoverable allocator condition into an unrecoverable kernel fault.
Attack Vector
An attacker requires local access and write permission on a file that resides on a mounted ocfs2 volume. The volume must be sufficiently fragmented to prevent contiguous allocation, and the target file must already contain an external xattr block. Invoking lsetxattr() with a large value under those conditions triggers the panic. Exploitation causes denial of service on the local node and, in clustered deployments, can disrupt shared workloads relying on the affected volume.
No verified exploit code is publicly available. See the Kernel Git Commit 743ac90 for the upstream fix.
Detection Methods for CVE-2026-80809
Indicators of Compromise
- Kernel panic messages referencing ocfs2_xattr_extend_allocation and BUG_ON(why == RESTART_META) in system logs
- Unexpected node reboots on clustered ocfs2 deployments correlated with setxattr-family syscalls
- Repeated lsetxattr failures returning -ENOSPC after the patch is applied, indicating stress against xattr allocation
Detection Strategies
- Audit kernel ring buffer output via dmesg and centralized log collection for ocfs2 stack traces containing ocfs2_add_clusters_in_btree and RESTART_META
- Correlate crash dumps captured by kdump with concurrent user activity to identify processes calling extended attribute syscalls
- Monitor filesystem fragmentation metrics on ocfs2 volumes and flag hosts where large xattr writes coincide with high fragmentation
Monitoring Recommendations
- Ingest /var/log/messages, journald, and kdump output into a centralized log platform for kernel oops and panic pattern matching
- Track syscall telemetry for setxattr, lsetxattr, and fsetxattr originating from non-administrative users on ocfs2 mounts
- Alert on host availability drops for cluster nodes that mount shared ocfs2 volumes
How to Mitigate CVE-2026-80809
Immediate Actions Required
- Apply the upstream kernel patches referenced in the stable tree commits and reboot affected nodes
- Inventory hosts mounting ocfs2 volumes and prioritize clustered production systems for patching
- Restrict local shell access on systems that cannot be patched immediately to reduce the attacker population
Patch Information
The fix adds the missing ocfs2_extend_meta_needed(&def_xv.xv.xr_list) call to the code path that handles files with an existing xattr block, aligning both paths. It also replaces the BUG_ON with a -ENOSPC return so residual allocator failures propagate to userspace instead of panicking. The patch is available across multiple stable branches through commits 04ba24b, 0cdc7dd, 50f0cbe, 6176313, 6a009f1, 743ac90, a3ccb57, b466340, and b9eb5c9.
Workarounds
- Defragment ocfs2 volumes and monitor free-space contiguity to lower the probability of triggering the panic path
- Constrain xattr size limits at the application layer to avoid large values that force additional extent allocations
- Where ocfs2 is not required, migrate workloads to alternative filesystems until patched kernels are deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
