CVE-2026-53041
ocfs2: fix listxattr handling when the buffer is full
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly. kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ... [CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode. That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer. [FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero. That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 14, 2026, 7:33 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to include the fix.
- Ensure probe mode detection uses buffer pointer, not buffer size.
- Verify block-xattr pass returns -ERANGE on buffer overflow.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53041.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53041 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53041
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53041 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53041 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.28 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d919b905939eda93393e3572900ff70dbad2b47f Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': 'a35a1c2b170b5b578b1b3fecb95694796552af9a', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': '2323084c17370304f49c84b354fe7b3edbb264fe', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': '6f702b00b8124c5d3525f19172934544826a114d', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': 'd919b905939eda93393e3572900ff70dbad2b47f', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': '46e66fefb83811958127bc9ad736983ec629d82b', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': '2685df8577a38d83b367c8cf52eda9dc286959ff', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': '50033ec1350fe68abdc63b950ced7ae57364b77a', 'versionType': 'git'}, {'status': 'affected', 'version': '936b8834366ec05f2a6993f73afd8348cac9718e', 'lessThan': 'd12f558e6200b3f47dbef9331ed6d115d2410e59', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/xattr.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.28'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.28', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/xattr.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix listxattr handling when the buffer is full [BUG] If an OCFS2 inode has both inline and block-based xattrs, listxattr() can return a size larger than the caller's buffer when the inline names consume that buffer exactly. kernel BUG at mm/usercopy.c:102! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102 Call Trace: __check_heap_object+0xe3/0x120 mm/slub.c:8243 check_heap_object mm/usercopy.c:196 [inline] __check_object_size mm/usercopy.c:250 [inline] __check_object_size+0x5c5/0x780 mm/usercopy.c:215 check_object_size include/linux/ucopysize.h:22 [inline] check_copy_size include/linux/ucopysize.h:59 [inline] copy_to_user include/linux/uaccess.h:219 [inline] listxattr+0xb0/0x170 fs/xattr.c:926 filename_listxattr fs/xattr.c:958 [inline] path_listxattrat+0x137/0x320 fs/xattr.c:988 __do_sys_listxattr fs/xattr.c:1001 [inline] __se_sys_listxattr fs/xattr.c:998 [inline] __x64_sys_listxattr+0x7f/0xd0 fs/xattr.c:998 ... [CAUSE] Commit 936b8834366e ("ocfs2: Refactor xattr list and remove ocfs2_xattr_handler().") replaced the old per-handler list accounting with ocfs2_xattr_list_entry(), but it kept using size == 0 to detect probe mode. That assumption stops being true once ocfs2_listxattr() finishes the inline-xattr pass. If the inline names fill the caller buffer exactly, the block-xattr pass runs with a non-NULL buffer and a remaining size of zero. ocfs2_xattr_list_entry() then skips the bounds check, keeps counting block names, and returns a positive size larger than the supplied buffer. [FIX] Detect probe mode by testing whether the destination buffer pointer is NULL instead of whether the remaining size is zero. That restores the pre-refactor behavior and matches the OCFS2 getxattr helpers. Once the remaining buffer reaches zero while more names are left, the block-xattr pass now returns -ERANGE instead of reporting a size larger than the allocated list buffer. Added Reference https://git.kernel.org/stable/c/2323084c17370304f49c84b354fe7b3edbb264fe Added Reference https://git.kernel.org/stable/c/2685df8577a38d83b367c8cf52eda9dc286959ff Added Reference https://git.kernel.org/stable/c/46e66fefb83811958127bc9ad736983ec629d82b Added Reference https://git.kernel.org/stable/c/50033ec1350fe68abdc63b950ced7ae57364b77a Added Reference https://git.kernel.org/stable/c/6f702b00b8124c5d3525f19172934544826a114d Added Reference https://git.kernel.org/stable/c/a35a1c2b170b5b578b1b3fecb95694796552af9a Added Reference https://git.kernel.org/stable/c/d12f558e6200b3f47dbef9331ed6d115d2410e59 Added Reference https://git.kernel.org/stable/c/d919b905939eda93393e3572900ff70dbad2b47f