CVE-2026-80638

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write occurs in the ocfs2 remove refcount extent() function when unlinking a refcounted file that has leaf blocks in its refcount tree. The issue arises when the last leaf block is removed and the root is converted back to leaf mode using a bulk memset on &rb->rf records. Because rf records shares an anonymous union with rf list, and rf list.l tree depth aliases rf records.rl count, a value of 0 for a single-level tree causes the memset to write beyond the 16-byte declared size of rf records, triggering a fortify panic.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.