Skip to main content

Linux Kernel EUVDEUVD-2026-38909

| CVE-2026-53041 HIGH
Out-of-bounds Write (CWE-787)
2026-06-24 Linux GHSA-gmx4-g5vq-2x9x
Buffer Overflow Linux Memory Corruption Red Hat Suse
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
7.1 HIGH

Local OCFS2 access by a low-privileged user (AV:L/PR:L), no interaction; oversized copy_to_user yields kernel memory disclosure (C:H) and panic (A:H) with no integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jun 28, 2026 - 08:55 vuln.today
CVSS changed
Jun 28, 2026 - 08:22 NVD
7.1 (HIGH)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 cve.org
HIGH 7.1
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix listxattr handling when the buffer is full

[BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly.

kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ...

[CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode.

That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer.

[FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero.

That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.

AnalysisAI

Memory-safety failure in the Linux kernel OCFS2 filesystem's listxattr() path allows a local low-privileged user to crash the kernel (and potentially leak adjacent kernel heap memory) when an OCFS2 inode carries both inline and block-based extended attributes. Introduced by refactor commit 936b8834366e, the bug causes copy_to_user() to be invoked with a length larger than the allocated list buffer, tripping the hardened usercopy check (kernel BUG at mm/usercopy.c:102). EPSS is low (0.18%, 7th percentile), there is no public exploit identified at time of analysis, and it is not in CISA KEV.

Technical ContextAI

OCFS2 is a shared-disk cluster filesystem in the mainline Linux kernel, commonly paired with Oracle clustering and shared SAN storage. Extended attributes (xattrs) in OCFS2 can live in two places: inline within the inode and in separate xattr blocks. The listxattr() syscall enumerates these names into a user-supplied buffer. The regression originates in commit 936b8834366e ('ocfs2: Refactor xattr list and remove ocfs2_xattr_handler()'), which centralized list accounting in ocfs2_xattr_list_entry() but continued to use 'remaining size == 0' as the sentinel for probe mode (where the kernel only counts the required length without copying). After the inline pass exactly fills the caller buffer, the block pass runs with a non-NULL buffer but zero remaining size; the helper misinterprets this as probe mode, skips the bounds check, keeps counting block names, and returns a total length exceeding the destination buffer. The root-cause class is an out-of-bounds/oversized buffer write into user space (CWE-787/CWE-125 family, improper buffer length validation); the input lists no CWE. The CPE data only generically identifies cpe:2.3:a:linux:linux, so the precise vulnerable subsystem (fs/ocfs2/xattr.c) must be taken from the description rather than the CPE.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, or 7.0.10 (or later) on the corresponding branch, or pull your distribution's patched kernel that backports the listxattr probe-mode fix (detecting probe mode by a NULL destination buffer instead of zero remaining size); the fix commits are at git.kernel.org/stable (e.g. https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a) and the advisory is at https://nvd.nist.gov/vuln/detail/CVE-2026-53041. If immediate patching is not possible, the most effective compensating control is to avoid using the OCFS2 filesystem where feasible - unmount OCFS2 volumes and blacklist the ocfs2 module (e.g. via modprobe blacklist) on hosts that do not require cluster storage, which fully removes the vulnerable code path but breaks any workload depending on OCFS2. Where OCFS2 must remain mounted, restrict which local users can access OCFS2 mount points and reduce untrusted local accounts, since the attack requires local access; keeping CONFIG_HARDENED_USERCOPY enabled converts the worst-case memory disclosure into a contained crash but does not prevent the resulting denial of service.

Same weakness CWE-787 – Out-of-bounds Write

View all
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2012-1889 HIGH POC
8.8
CVE-2010-3333 HIGH POC
7.8
CVE-2014-1761 HIGH POC
7.8
CVE-2009-3129 HIGH POC
7.8
CVE-2021-1732 HIGH POC
7.8
CVE-2013-3346 CRITICAL POC
9.8

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.168 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.149 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.197 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.145 Affected
Container suse/sle-micro-rancher/5.3:latest Container suse/sle-micro-rancher/5.4:5.4.4.5.149 Affected
Container suse/sle-micro/base-5.5:2.0.4-5.8.296 Affected
Container suse/sle-micro/kvm-5.5:2.0.4-3.5.570 Affected

Share

EUVD-2026-38909 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy