CVE-2026-53039
ocfs2: validate group add input before caching
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching [BUG] OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(): kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d [CAUSE] ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead. [FIX] Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 14, 2026, 7:34 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Validate on-disk group descriptor before caching.
- Add descriptor to metadata cache.
- Ensure buffer lifetime consistency.
- Update Linux kernel to the latest version.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53039.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53039 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53039
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53039 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53039 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Added CWE CWE-617 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.25 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/22544ddedf381ed5191cfc783aea8d6c936bc201 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6c5e70409c1961fe1278968f038eaaed6cc1145a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/70b672833f4025341c11b22c7f83778a5cd611bc Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/76bd722db0a92b84ccd99e03796a0b6f1ae71c31 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/aed87e866d1a321edb9703563c2faa8fec89835d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b9ae3942deec4c9e3fa2070521f90910f7490011 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f7e139d7563f6947ad509fb468903941d0bb7ddd Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': 'f7e139d7563f6947ad509fb468903941d0bb7ddd', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': '22544ddedf381ed5191cfc783aea8d6c936bc201', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': '76bd722db0a92b84ccd99e03796a0b6f1ae71c31', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': 'b9ae3942deec4c9e3fa2070521f90910f7490011', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': 'e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': 'aed87e866d1a321edb9703563c2faa8fec89835d', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': '6c5e70409c1961fe1278968f038eaaed6cc1145a', 'versionType': 'git'}, {'status': 'affected', 'version': '7909f2bf835376a20d6dbf853eb459a27566eba2', 'lessThan': '70b672833f4025341c11b22c7f83778a5cd611bc', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/resize.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.25'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.25', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/resize.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching [BUG] OCFS2_IOC_GROUP_ADD can trigger a BUG_ON in ocfs2_set_new_buffer_uptodate(): kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2_set_new_buffer_uptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2_group_add+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2_ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 x64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d [CAUSE] ocfs2_group_add() calls ocfs2_set_new_buffer_uptodate() on a user-controlled group block before ocfs2_verify_group_and_input() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODE_CACHE(inode) even though the group descriptor belongs to main_bm_inode and later journal accesses use that cache context instead. [FIX] Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODE_CACHE(main_bm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup. Added Reference https://git.kernel.org/stable/c/22544ddedf381ed5191cfc783aea8d6c936bc201 Added Reference https://git.kernel.org/stable/c/6c5e70409c1961fe1278968f038eaaed6cc1145a Added Reference https://git.kernel.org/stable/c/70b672833f4025341c11b22c7f83778a5cd611bc Added Reference https://git.kernel.org/stable/c/76bd722db0a92b84ccd99e03796a0b6f1ae71c31 Added Reference https://git.kernel.org/stable/c/aed87e866d1a321edb9703563c2faa8fec89835d Added Reference https://git.kernel.org/stable/c/b9ae3942deec4c9e3fa2070521f90910f7490011 Added Reference https://git.kernel.org/stable/c/e7c2cb552e6eb85c0f5aefdd7f0f7c3c8591a6a3 Added Reference https://git.kernel.org/stable/c/f7e139d7563f6947ad509fb468903941d0bb7ddd