CVE-2026-53039

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ocfs2: validate group add input before caching<br /> <br /> [BUG]<br /> OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in<br /> ocfs2_set_new_buffer_uptodate():<br /> <br /> kernel BUG at fs/ocfs2/uptodate.c:509!<br /> Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI<br /> RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509<br /> Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df<br /> Call Trace:<br /> ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507<br /> ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887<br /> vfs_ioctl fs/ioctl.c:51 [inline]<br /> __do_sys_ioctl fs/ioctl.c:597 [inline]<br /> __se_sys_ioctl fs/ioctl.c:583 [inline]<br /> __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583<br /> x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17<br /> do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]<br /> do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94<br /> entry_SYSCALL_64_after_hwframe+0x76/0x7e<br /> RIP: 0033:0x7bbfb55a966d<br /> <br /> [CAUSE]<br /> ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a<br /> user-controlled group block before ocfs2_verify_group_and_input()<br /> validates that block number. That helper is only valid for newly<br /> allocated metadata and asserts that the block is not already present in<br /> the chosen metadata cache. The code also uses INODE_CACHE(inode) even<br /> though the group descriptor belongs to main_bm_inode and later journal<br /> accesses use that cache context instead.<br /> <br /> [FIX]<br /> Validate the on-disk group descriptor before caching it, then add it to<br /> the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the<br /> validation failure path separate from the later cleanup path so we only<br /> remove the buffer from that cache after it has actually been inserted.<br /> This keeps the group buffer lifetime consistent across validation,<br /> journaling, and cleanup.