CVE-2026-90320

A flaw was found in the Oracle Cluster File System 2 ocfs2 component of the Linux kernel. This vulnerability occurs due to insufficient validation of external extended attribute xattr entries when reading metadata. A local attacker could craft malicious xattr metadata, leading to a use-after-free...

CVE-2026-90322

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 cluster heartbeat mechanism. When a local node within the cluster is reset, an internal flag is not properly cleared, leading to an inconsistent state. This inconsistency can cause the system's heartbeat monitoring process ...

CVE-2026-90301

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System version 2 heartbeat mechanism. This vulnerability arises from a race condition during the management of heartbeat regions and their associated network handlers. A remote attacker could exploit this timing issue to trigger a...

CVE-2026-90205

A flaw was found in ocfs2 within the Linux kernel. OCFS2 trusts active orphan slot data read from disk inodes without proper validation. A corrupted inode could lead to an out-of-bounds memory access when processing orphan slots, potentially causing system instability or a denial of service...

CVE-2026-90204

A flaw was found in the Linux kernel's OCFS2 Oracle Cluster File System 2 component. A local attacker could exploit a vulnerability where a corrupted filesystem metadata entry, specifically an append-DIO dinode, contains an out-of-range orphan slot value. The OCFS2 dinode validator fails to...

Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-8646-1)

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8646-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update corrects flaws in...

Ubuntu 16.04 LTS / 18.04 LTS : Linux kernel vulnerabilities (USN-8644-1)

The remote Ubuntu 16.04 LTS / 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-8644-1 advisory. Several security issues were discovered in the Linux kernel. An attacker could possibly use these to compromise the system. This update...

Oracle Linux 10 / 9 : Unbreakable Enterprise kernel (ELSA-2026-500374)

The remote Oracle Linux 10 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-500374 advisory. - mptcp: fix bad accounting in mptcpsubflowpushpending Paolo Abeni Orabug: 40078583 CVE-2026-97522 - mptcp: close race between scheduler and sta...

K000163577: Multiple Linux kernel vulnerabilities

Security Advisory Description CVE-2026-53039 In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate group add input before caching BUG OCFS2IOCGROUPADD can trigger a BUGON in ocfs2setnewbufferuptodate: kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 ...

ROS-20261007-73-0135

The vulnerability of the ocfs2fault function in the fs/ocfs2/mmap.c file of the Ocfs2 file system in the Linux operating system is related to the reutilization of previously freed memory. Exploiting this vulnerability could allow an attacker to compromise the confidentiality, integrity, and...

Unbreakable Enterprise kernel security update

6.12.0-207.111.5.1 - selftests/mm/khugepaged: include kselftest.h in khugepaged Sherry Yang Orabug: 40099804 6.12.0-207.111.5 - Rename ONOS kernel flavor to OSP for OL9 and OL10 Vijay Kumar Orabug: 40055216 - tcp: Remove hashinfo test for inet6?lookuprunsklookup. Kuniyuki Iwashima Orabug: 4005230...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: removing an entry instead of using null-ptr-dereference in ocfs2xaremove Syzkaller can trigger null-ptr-dereference in ocfs2xaremove: 57.319872 a.out,1161,7:ocfs2xaremove:2028 ERROR: status = -12 57.320420...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed a circular locking dependency in ocfs2initacl. A lockdep warning indicates a circular locking dependency between &oi-ipxattrsem and &journal-jtransbarrier: WARNING: A circular locking dependency was detected. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: The uncached inode has failed to enter the group. Syzbot has reported the following BUG: Kernel BUG at fs/ocfs2/uptodate.c:509! … Call Trace: ? diebody+0x5f/0xb0 ? die+0x9e/0xc0 ? dotrap+0x15a/0x3a0 ?...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: fixed a recursive semaphore deadlock in the fiemap call syzbot detected a OCFS2 hang due to a recursive semaphore on the FSIOCFIEMAP of the extent list in a specially crafted mmap file. contextswitch...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: ocfs2: A double-free operation was corrected in userclusterconnect. userclusterdisconnect frees "conn-ccprivate", which is actually "lc". However, the error handling frees "lc" again. Setting "lc" to NULL in this case can prevent...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Do not call BUGON on an invalid journal dinode. BUG A corrupted OCFS2 image can corrupt the current slot journal dinode while mounting is still in progress. The mount path first reports the invalid journal block and then...

Astra Linux – Vulnerabilities in Linux, Linux-5.10, Linux-5.15, Linux-6.1

In the Linux kernel, the following vulnerabilities have been resolved: ocfs2: Fixed races between hole punching and AIO+DIO. After the commit “ocfs2: return real error code in ocfs2diowrgetblock”, fstests/generic/300 became from always failing to sometimes failing...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Synchronize heartbeat callbacks with o2net teardown This patch addresses two issues related to OCFS2 heartbeat/runs during o2net teardown. This patch fixes the issue where heartbeat callbacks remain registered even when...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1

In the Linux kernel, the following vulnerability has been resolved: ocfs2: Fixed a NULL pointer dereference in ocfs2assuretranscredits. BREAK A direct write over unwritten extents can cause the kernel to panic in ocfs2assuretranscredits, especially when the journal aborts during DIO completion...