CVE-2026-89496: Linux Kernel Use-After-Free Vulnerability

CVE-2026-89496 Overview

CVE-2026-89496 is a memory leak vulnerability in the Linux kernel's Oracle Cluster File System 2 (OCFS2) implementation. The flaw resides in the copy-on-write (COW) completion path, where deallocation lists tracked by ocfs2_cache_block_dealloc() are not consistently freed. Local fuzzing of kernel version 6.12.94 uncovered the leak while exercising copy_file_range() within the same filesystem. Repeated triggering of the code path causes progressive kernel memory exhaustion on hosts that mount OCFS2 volumes.

Critical Impact
Local users with access to an OCFS2 mount can trigger repeated kernel slab allocations that are never freed, leading to memory exhaustion and potential denial of service on affected Linux systems.

Affected Products

Linux kernel OCFS2 filesystem module
Linux kernel 6.12.94 (confirmed via fuzzing)
Stable branches referenced by the fix commits listed in the kernel.org advisory

Discovery Timeline

2026-09-11 - CVE-2026-89496 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2026-89496

Vulnerability Analysis

The vulnerability lives in the OCFS2 refcount tree and extent allocator code paths. When copy_file_range() is invoked within a single OCFS2 filesystem, the kernel performs a copy-on-write operation through ocfs2_refcount_cow() and ocfs2_replace_cow(). During extent splitting and tree rotation, ocfs2_cache_block_dealloc() allocates per-slot dealloc tracking structures via kmalloc() and kzalloc().

Under certain COW completion paths, the code returns without executing the pending deallocation batch. The tracking structures allocated in ocfs2_find_per_slot_free_list() and in fs/ocfs2/alloc.c:6793 remain orphaned. kmemleak reports 32-byte unreferenced objects each time the path is exercised. The fix ensures deallocs always run at COW completion.

Root Cause

The root cause is a missing deallocation invocation in the COW completion logic. Freelist tracking objects created during ocfs2_unlink_path() and subsequent tree rotations are only flushed on some exit paths. When execution falls through an alternate branch, the allocations leak. This qualifies as a kernel memory leak affecting the OCFS2 subsystem.

Attack Vector

Exploitation requires local access and a mounted OCFS2 filesystem the attacker can write to. The attacker repeatedly invokes copy_file_range() or sendfile() targeting shared refcounted extents on the same OCFS2 volume. Each invocation leaks slab memory. Sustained abuse depletes kernel memory and degrades or halts the system. Verified proof-of-concept code is not published in the advisory; the mechanism is documented in the referenced kernel commits.

Detection Methods for CVE-2026-89496

Indicators of Compromise

Growing kmalloc-32 slab consumption reported by /proc/slabinfo on hosts mounting OCFS2 volumes.
kmemleak reports referencing ocfs2_cache_block_dealloc, ocfs2_find_per_slot_free_list, or ocfs2_unlink_path in the allocation backtrace.
Unexplained kernel memory pressure or OOM events on OCFS2 cluster nodes.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and scan for OCFS2-related unreferenced objects after workload runs that use copy_file_range().
Correlate slab growth trends with process telemetry to identify users repeatedly issuing intra-filesystem copy operations against OCFS2 mounts.
Track kernel version and OCFS2 module fingerprints across the fleet to identify hosts running unpatched builds.

Monitoring Recommendations

Baseline slab allocator statistics on OCFS2 nodes and alert on sustained upward drift of kmalloc-32 and related caches.
Monitor syscall telemetry for high-frequency copy_file_range and sendfile calls from non-privileged users on OCFS2 paths.
Aggregate kernel logs centrally to catch kmemleak and OOM-killer events that reference OCFS2 call sites.

How to Mitigate CVE-2026-89496

Immediate Actions Required

Inventory Linux hosts that mount OCFS2 volumes and identify kernel versions in scope of the referenced stable-branch fixes.
Apply the upstream stable-kernel patches listed in the kernel.org references and reboot affected nodes during a maintenance window.
Restrict write access to OCFS2 mounts to trusted users until patched kernels are deployed.

Patch Information

The fix is distributed across multiple stable branches. Reference commits include 09e93a60, 123c050e, 2753e128, 5ff30f07, 71f07b7f, 82ea9d4f, a4adaa72, and f0261b3a. The change ensures deallocations always run on COW completion.

Workarounds

Where patching is not immediately possible, unmount OCFS2 filesystems on systems that do not require them.
Limit exposure by removing write permissions for untrusted local accounts on OCFS2 mounts.
Schedule periodic reboots on affected cluster nodes to reclaim leaked kernel memory until the patch is deployed.

bash

# Verify the running kernel and check for OCFS2 usage
uname -r
lsmod | grep ocfs2
mount | grep ocfs2

# Inspect slab growth for the affected cache
grep '^kmalloc-32 ' /proc/slabinfo