Skip to main content

Linux Kernel ocfs2 EUVDEUVD-2026-25489

| CVE-2026-31596 MEDIUM
2026-04-24 Linux GHSA-hvjf-55rw-w8jm
Denial Of Service Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local attack vector with low privileges required; crafted filesystem triggers kernel panic causing high availability impact with no confidentiality or integrity effects.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 02:57 vuln.today
CVSS changed
Apr 29, 2026 - 14:38 NVD
5.5 (MEDIUM)
Patch released
Apr 29, 2026 - 14:18 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25489
CVE Published
Apr 24, 2026 - 14:42 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: handle invalid dinode in ocfs2_group_extend

[BUG] kernel BUG at fs/ocfs2/resize.c:308! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308 Code: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe Call Trace: ... ocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e ...

[CAUSE] ocfs2_group_extend() assumes that the global bitmap inode block returned from ocfs2_inode_lock() has already been validated and BUG_ONs when the signature is not a dinode. That assumption is too strong for crafted filesystems because the JBD2-managed buffer path can bypass structural validation and return an invalid dinode to the resize ioctl.

[FIX] Validate the dinode explicitly in ocfs2_group_extend(). If the global bitmap buffer does not contain a valid dinode, report filesystem corruption with ocfs2_error() and fail the resize operation instead of crashing the kernel.

AnalysisAI

Kernel panic in the Linux kernel's ocfs2 (Oracle Cluster File System 2) resize path allows a local low-privileged user to crash the system via a crafted filesystem image. The ocfs2_group_extend() function in fs/ocfs2/resize.c:308 unconditionally asserts that the global bitmap buffer contains a valid dinode signature using BUG_ON, but the JBD2 journaling layer's buffer path bypasses structural validation, permitting an invalid dinode to reach the resize ioctl and trigger a kernel BUG. No active exploitation is confirmed (not in CISA KEV), and EPSS stands at 0.02% (5th percentile), reflecting minimal exploitation activity; patches are available across multiple stable kernel branches.

Technical ContextAI

ocfs2 is a shared-disk clustered filesystem included in the mainline Linux kernel, primarily deployed in Oracle RAC and similar clustered storage environments. The vulnerability is in fs/ocfs2/resize.c, specifically the ocfs2_group_extend() function invoked via the OCFS2_IOC_GROUP_EXTEND ioctl (reached through ocfs2_ioctl() at fs/ocfs2/ioctl.c:869). The function retrieves the global bitmap inode buffer via ocfs2_inode_lock() and then uses BUG_ON to assert the buffer holds a valid dinode - a hard kernel assertion that, when false, halts the kernel with an 'invalid opcode' oops rather than returning an error. The JBD2 (ext3/ext4/ocfs2 journaling layer) buffer path can supply structurally unvalidated blocks from disk, meaning a crafted filesystem can slip an invalid dinode past the lock path and reach the assertion. The root cause maps to CWE-617 (Reachable Assertion) combined with CWE-20 (Improper Input Validation) - the fix replaces BUG_ON with explicit dinode validation and graceful corruption reporting via ocfs2_error(). The CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

The primary fix is to upgrade to a patched Linux kernel version: 6.12.83, 6.18.24, 6.19.14, or 7.0.1, as documented by upstream stable commits at git.kernel.org and EUVD-2026-25489. Ubuntu users should apply the kernel packages referenced in USN-8488-1 (https://ubuntu.com/security/notices/USN-8488-1). For distributions not yet shipping patched kernels, a highly effective compensating control is to prevent untrusted local users from mounting ocfs2 filesystems or issuing ioctl calls against ocfs2 volumes - restrict CAP_SYS_ADMIN and filesystem mount capabilities via systemd service hardening (NoNewPrivileges, PrivateMounts) or kernel lockdown. Systems where ocfs2 is not needed can blacklist the ocfs2 kernel module (add 'blacklist ocfs2' to /etc/modprobe.d/) at no functional cost. No workaround fully substitutes for patching on systems actively using ocfs2 in multi-tenant environments.

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

EUVD-2026-25489 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy