CVE-2026-80638

A flaw was found in the ocfs2 component of the Linux kernel. When a user unlinks a refcounted file whose refcount tree has leaf blocks, an out-of-bounds write occurs within the ocfs2_remove_refcount_extent() function. This happens because a memset operation writes past the intended memory boundary due to an incorrect size calculation. A successful exploit of this vulnerability can lead to a system crash, resulting in a denial of service (DoS).

A moderate-severity out-of-bounds write flaw was found in the ocfs2 file system implementation of the Linux kernel. When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root block back to leaf mode using a bulk memset on rf_records whose size is derived from rl_count; because rl_count aliases l_tree_depth and is 0 for a single-level tree, the memset writes past the end of the 16-byte rf_records array. A local user able to unlink a refcounted file whose refcount tree has leaf blocks on a mounted ocfs2 file system could use this flaw to crash the kernel, resulting in a denial of service. Red Hat rated this flaw Moderate (CVSS 5.5, AV:L/AC:L/PR:L, availability impact only), which differs from the CVE.org score of 8.8 that assumes a network attack vector; the higher upstream score is not supported by the technical evidence, as the flaw is reachable only through local file system operations and its documented consequence is a system crash with no confidentiality or integrity impact. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel, kernel-rt, and kernel-ivos-qualcomm versions are not affected because the vulnerable code, introduced in the upstream 6.19 kernel development cycle, is not present in the Red Hat kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.