CVE-2026-89493 Overview
CVE-2026-89493 is an out-of-bounds read and write vulnerability in the Linux kernel's Oracle Cluster File System version 2 (OCFS2) refcount block validator. The function ocfs2_validate_refcount_block() fails to validate the on-disk rl_used and rl_count fields against the fixed per-block capacity returned by ocfs2_refcount_recs_per_rb(). A crafted or corrupted refcount block with rl_used == 0xffff causes ocfs2_find_refcount_rec_in_rl() to walk past the end of a 4096-byte metadata block, and drives an out-of-bounds memmove() of roughly 1 MiB in ocfs2_insert_refcount_rec().
Critical Impact
A local attacker with CAP_SYS_ADMIN who mounts a crafted OCFS2 image, or who writes raw blocks to the device backing a mounted OCFS2 filesystem, can trigger kernel memory corruption reachable through an ordinary reflink (FICLONE) operation.
Affected Products
- Linux kernel builds shipping OCFS2 prior to the patched commits
- Distributions packaging Linux kernel versions containing the vulnerable fs/ocfs2/refcounttree.c validator
- Systems mounting OCFS2 filesystems from untrusted or attacker-controlled block devices
Discovery Timeline
- 2026-09-11 - CVE-2026-89493 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89493
Vulnerability Analysis
The OCFS2 refcount tree stores refcount records in an on-disk array rl_recs[] inside a single metadata block. On the common 4K block configuration, the real capacity is fixed at 247 records of 16 bytes each, as returned by ocfs2_refcount_recs_per_rb(sb). The header fields rl_used and rl_count are read directly from disk but are never checked against that fixed capacity, nor against each other, before consumers walk the array.
The sibling function ocfs2_validate_extent_block() in fs/ocfs2/alloc.c already performs the equivalent capacity and bounds checks for extent-list headers. The refcount validator omitted this class of check, leaving the read path exposed to attacker-controlled counters.
Root Cause
ocfs2_find_refcount_rec_in_rl() iterates while i < le16_to_cpu(rb->rf_records.rl_used) and dereferences &rb->rf_records.rl_recs[i] each iteration. When rl_used equals 0xffff, the loop reads well past the 4 KiB block boundary. The resulting index is then passed to ocfs2_insert_refcount_rec(), which performs a memmove() sized as (rl_used - index) * sizeof(struct ocfs2_refcount_rec). This produces a copy of up to roughly 1 MiB from an origin already outside the block, corrupting adjacent kernel memory.
Attack Vector
The attacker model is local. An adversary with CAP_SYS_ADMIN mounts a crafted OCFS2 image, or performs raw writes to the block device backing an already-mounted OCFS2 filesystem. The corruption is reached through a standard reflink system call (FICLONE) against a file whose extent cpos sorts past every real record in the leaf, forcing the lookup to run off the end of the array rather than returning early on a match. Successful exploitation can yield kernel memory disclosure, denial of service, or privilege escalation depending on adjacent allocations.
Refer to the upstream patch commits linked in the kernel.org stable tree for the exact validator changes.
Detection Methods for CVE-2026-89493
Indicators of Compromise
- Kernel log entries from ocfs2_error() referencing invalid rl_count or rl_used values in refcount blocks
- KASAN reports in __ocfs2_increase_refcount() or ocfs2_insert_refcount_rec() on kernels built with KASAN_GENERIC
- Unexpected kernel oops or panic traces referencing ocfs2_find_refcount_rec_in_rl during FICLONE operations
- Mount events for OCFS2 images sourced from removable media or user-writable paths
Detection Strategies
- Audit mount syscalls with filesystem type ocfs2 originating from non-administrator workflows or unusual paths
- Monitor for ioctl calls with the FICLONE command against files residing on OCFS2 volumes on hosts that do not typically use reflink
- Correlate kernel ring buffer ocfs2 error messages with the process and user that initiated the triggering syscall
Monitoring Recommendations
- Forward dmesg and /var/log/kern.log to a central log store and alert on OCFS2 and KASAN strings
- Track CAP_SYS_ADMIN grants and container capability sets that would allow untrusted mounts
- Baseline OCFS2 usage per host and alert on new mount points or new block devices presenting an OCFS2 superblock
How to Mitigate CVE-2026-89493
Immediate Actions Required
- Apply the upstream kernel patch series that adds rl_count capacity and rl_used <= rl_count checks to ocfs2_validate_refcount_block()
- Restrict CAP_SYS_ADMIN and disable user-initiated mounts of OCFS2 images on multi-tenant systems
- Prevent untrusted users from writing raw blocks to devices backing mounted OCFS2 filesystems
Patch Information
The fix adds two validation checks in ocfs2_validate_refcount_block(): it rejects refcount blocks whose rl_count does not match ocfs2_refcount_recs_per_rb(sb), and rejects rl_used > rl_count. Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set, since that flag indicates the union holds rf_list rather than rf_records. See the mainline and stable commits: 04ead70, 0761d2c, 4ca62df, 5593b63, 97584e9, af56e90, c8b02f4, and f882e9e.
Workarounds
- Unload or blacklist the ocfs2 kernel module on systems that do not require it
- Remove OCFS2 filesystems from /etc/fstab auto-mount entries where feasible until patched kernels are deployed
- Enforce that OCFS2 storage originates only from trusted, integrity-verified block devices
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
