Linux Kernel EUVD-2026-67514

Exploitation requires all of the following conditions to be simultaneously true: the target system must have the OCFS2 kernel module loaded and an OCFS2 filesystem actively mounted - this is non-default and absent on the vast majority of Linux systems; the attacker must hold write access (PR:L) to the OCFS2 volume to create and delete files; a file on that volume must be refcounted, meaning it was previously created via a reflink or clone operation; and the refcount tree for that file must contain at least one leaf block at the time of unlinking. Systems not running OCFS2 are entirely unaffected regardless of kernel version. Exploitation is further limited by CONFIG_FORTIFY_SOURCE, present in most security-hardened distributions, which converts the bug into an immediate kernel panic rather than silent memory corruption exploitable for privilege escalation.

The provided CVSS score of 8.8 with AV:N/AC:L/PR:L significantly overstates the attack surface: the vulnerability is triggered by a local filesystem operation - unlinking a refcounted file on an OCFS2 volume - not a network-reachable code path, and requires OCFS2 to be actively mounted, which is a non-default configuration absent from most Linux deployments. CVSS indicates a network attack vector, but the description implies local filesystem access is required - verify with the upstream kernel security team before using the provided score for prioritization. The EPSS score of 0.15% at the 5th percentile strongly corroborates low real-world exploitation likelihood. There is no CISA KEV listing and no public POC has been identified. Even in environments running OCFS2, the primary risk on CONFIG_FORTIFY_SOURCE-hardened distributions is a kernel panic (availability impact) rather than reliable code execution, since converting an out-of-bounds memset into kernel privilege escalation requires additional exploitation primitives beyond the documented primitive.

A low-privileged user with write access to an OCFS2-mounted cluster volume creates a refcounted file using a reflink operation, then unlinks it - causing ocfs2_remove_refcount_extent() to execute a memset past the declared buffer boundary into adjacent kernel memory. On CONFIG_FORTIFY_SOURCE-hardened kernels this immediately panics the cluster node; on unprotected builds, the adjacent kernel memory corruption could potentially be developed into a privilege-escalation primitive requiring additional exploitation effort.