CVE-2026-89490: Linux Kernel OCFS2 Privilege Escalation

CVE-2026-89490 Overview

CVE-2026-89490 is a Linux kernel vulnerability in the Oracle Cluster File System version 2 (OCFS2) that causes directory readdir position truncation on 32-bit kernels. The flaw resides in ocfs2_dir_foreach_blk_el(), where a bitwise mask is computed using unsigned long rather than loff_t. When a directory grows large enough to cross the 4 GiB boundary, the high 32 bits of the ctx->pos cookie are silently cleared. This causes readdir() to reset back into the first 4 GiB block and re-enumerate already-returned directory entries indefinitely. 64-bit kernels are unaffected.

Critical Impact
On 32-bit kernels, applications iterating over OCFS2 directories larger than 4 GiB enter an infinite re-enumeration loop, breaking directory traversal and denying reliable filesystem operations.

Affected Products

Linux kernel OCFS2 filesystem on 32-bit architectures
Systems mounting non-inline OCFS2 directories that exceed 4 GiB
Applications relying on readdir() for OCFS2 directory enumeration on 32-bit kernels

Discovery Timeline

2026-09-11 - CVE-2026-89490 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89490

Vulnerability Analysis

The vulnerability is a numeric truncation error in the OCFS2 directory iteration path. In ocfs2_dir_foreach_blk_el(), the directory cookie position is rebuilt with the expression ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) | offset;. Here ctx->pos is a signed 64-bit loff_t, while sb->s_blocksize is an unsigned long. On 32-bit kernels, unsigned long is 32 bits wide, so the mask ~(sb->s_blocksize - 1) evaluates as a 32-bit unsigned value such as 0xfffff000 for a 4 KiB block size. Standard C arithmetic conversions zero-extend that operand to 64 bits, producing 0x00000000fffff000 and clearing the upper 32 bits of ctx->pos during the AND operation.

Root Cause

The root cause is an integer type mismatch that triggers implicit zero-extension of a 32-bit unsigned mask before combination with a 64-bit signed offset. Because OCFS2 permits directories larger than 4 GiB, the position cookie legitimately uses bits above bit 31. Truncating those bits corrupts the resume position for subsequent readdir syscalls. This is the same class of bug fixed in exfat by commit 3dce5bb82c97 and mirrored by an equivalent ext4 fix in the same patch series.

Attack Vector

The affected code path is ocfs2_dir_foreach_blk_el(), the extent-list readdir path used for all non-inline OCFS2 directories. Any local user or process with read access to a sufficiently large OCFS2 directory on a 32-bit kernel can trigger the condition simply by invoking readdir(). When iteration crosses the 4 GiB boundary, the cookie resets and the re-validation path re-emits previously returned dirents in an unbounded loop. The condition manifests as a functional denial of service against directory enumeration rather than a memory corruption primitive. See the upstream kernel commit for the applied fix.

Detection Methods for CVE-2026-89490

Indicators of Compromise

Processes on 32-bit kernels stuck in long-running or non-terminating getdents/readdir syscalls against OCFS2 mounts.
Repeated returns of the same directory entries by user-space tools such as ls, find, or backup agents on OCFS2 directories that exceed 4 GiB.
Sustained kernel CPU consumption tied to OCFS2 directory iteration without progress toward completion.

Detection Strategies

Inventory hosts running 32-bit Linux kernels with OCFS2 mounts and identify directories whose on-disk size approaches or exceeds 4 GiB.
Compare running kernel versions against the fixed commits listed in the kernel.org references to identify unpatched systems.
Instrument syscall tracing (for example strace or eBPF getdents probes) on suspect workloads to observe repeated cookie positions returned to user space.

Monitoring Recommendations

Alert on backup, indexing, or replication jobs that fail to complete traversal of OCFS2 directories within expected runtimes.
Track kernel CPU time attributed to OCFS2 filesystem operations and flag sustained anomalies.
Monitor filesystem package and kernel update state across the fleet to confirm patch adoption on 32-bit systems.

How to Mitigate CVE-2026-89490

Immediate Actions Required

Apply the upstream Linux kernel patch that casts the block size operand to loff_t before the mask is computed on all affected 32-bit systems.
Prioritize patching hosts running 32-bit kernels with OCFS2 mounts that hold directories larger than 4 GiB.
Rebuild and redeploy custom or embedded 32-bit kernels that vendor OCFS2 support from source.

Patch Information

The fix changes the expression to ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) | offset;, forcing the mask to be evaluated as a 64-bit value. Stable kernel updates are available across multiple branches; see the eight upstream commits including c28dc3407937, 1ae7029823ae, 94569154ba49, a63308ab426f, b53e2b271eeb, c0c165487a2e, f9dd5cad8d09, and 1001fb3b69a1.

Workarounds

Migrate affected workloads to 64-bit kernels, which are not impacted by this truncation.
Constrain OCFS2 directory sizes on 32-bit systems so they remain below the 4 GiB boundary until the kernel patch is applied.
Avoid running long-lived directory enumeration tasks (backups, indexers) against large OCFS2 directories on unpatched 32-bit hosts.

bash

# Verify running kernel architecture and version to determine exposure
uname -m
uname -r

# Identify mounted OCFS2 filesystems
mount -t ocfs2

# Check for OCFS2 directories approaching or exceeding 4 GiB in on-disk size
find /path/to/ocfs2/mount -xdev -type d -printf '%s %p\n' | awk '$1 >= 4294967296'