PT-2026-43947 · Linux · Linux

Published 2026-05-27 · Updated 2026-05-27 · CVE-2026-46080

NVD

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: split transactions in dio completion to avoid credit exhaustion

During ocfs2 dio operations, JBD2 may report warnings via following call trace: ocfs2 dio end io write ocfs2 mark extent written ocfs2 change extent flag ocfs2 split extent ocfs2 try to merge extent ocfs2 extend rotate transaction ocfs2 extend trans jbd2 journal restart start this handle output: JBD2: kworker/6:2 wants too many credits credits:5450 rsv credits:0 max:5449

To prevent exceeding the credits limit, modify ocfs2 dio end io write() to handle extents in a batch of transaction.

Additionally, relocate ocfs2 del inode from orphan(). The orphan inode should only be removed from the orphan list after the extent tree update is complete. This ensures that if a crash occurs in the middle of extent tree updates, we won't leave stale blocks beyond EOF.

This patch also changes the logic for updating the inode size and removing orphan, making it similar to ext4 dio write end io(). Both operations are performed only when everything looks good.

Finally, thanks to Jans and Joseph for providing the bug fix prototype and suggestions.

Related Identifiers

CVE-2026-46080

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-46080 · Security Note
• https://git.kernel.org/stable/c/886f97fa59d0bbfa9859fb1a66dd9e014b522d89 · Note
• https://git.kernel.org/stable/c/3c636a3edca9c3f180b3079f94fe7e115730d9c6 · Note
• https://git.kernel.org/stable/c/ea5bb1d20da756e4f41a48dad42b2e7d6e73f71e · Note
• https://git.kernel.org/stable/c/069c3fb310e9336cf48cfdf8748a32c29fd0193d · Note
• https://git.kernel.org/stable/c/d647c5b2fbf81560818dacade360abc8c00a9665 · Note