PT-2026-51935 · Linux · Linux
Publicado
2026-06-24
·
Atualizado
2026-06-24
·
CVE-2026-53041
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix listxattr handling when the buffer is full
[BUG]
If an OCFS2 inode has both inline and block-based xattrs, listxattr()
can return a size larger than the caller's buffer when the inline names
consume that buffer exactly.
kernel BUG at mm/usercopy.c:102!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:usercopy abort+0xb7/0xd0 mm/usercopy.c:102
Call Trace:
check heap object+0xe3/0x120 mm/slub.c:8243
check heap object mm/usercopy.c:196 [inline]
check object size mm/usercopy.c:250 [inline]
check object size+0x5c5/0x780 mm/usercopy.c:215
check object size include/linux/ucopysize.h:22 [inline]
check copy size include/linux/ucopysize.h:59 [inline]
copy to user include/linux/uaccess.h:219 [inline]
listxattr+0xb0/0x170 fs/xattr.c:926
filename listxattr fs/xattr.c:958 [inline]
path listxattrat+0x137/0x320 fs/xattr.c:988
do sys listxattr fs/xattr.c:1001 [inline]
se sys listxattr fs/xattr.c:998 [inline]
x64 sys listxattr+0x7f/0xd0 fs/xattr.c:998
...
[CAUSE]
Commit 936b8834366e ("ocfs2: Refactor xattr list and remove
ocfs2 xattr handler().") replaced the old per-handler list accounting
with ocfs2 xattr list entry(), but it kept using size == 0 to detect
probe mode.
That assumption stops being true once ocfs2 listxattr() finishes the
inline-xattr pass. If the inline names fill the caller buffer exactly,
the block-xattr pass runs with a non-NULL buffer and a remaining size of
zero. ocfs2 xattr list entry() then skips the bounds check, keeps
counting block names, and returns a positive size larger than the
supplied buffer.
[FIX]
Detect probe mode by testing whether the destination buffer pointer is
NULL instead of whether the remaining size is zero.
That restores the pre-refactor behavior and matches the OCFS2 getxattr
helpers. Once the remaining buffer reaches zero while more names are
left, the block-xattr pass now returns -ERANGE instead of reporting a
size larger than the allocated list buffer.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux