CVE-2026-80809

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix missing metadata reservation for large xattrs

[BUG] lsetxattr() panics the kernel when setting a large xattr value on a fragmented filesystem where the file already has an external xattr block.

[CAUSE] ocfs2 calc xattr set need() never reserves metadata blocks for a new xattr value's extent tree when the file already has an external xattr block. The not found path leaves meta add at zero, so meta ac is NULL when ocfs2 xattr extend allocation() runs.

A new value root has room for a single extent record. On a fragmented filesystem, the allocator cannot satisfy the xattr value in one contiguous run, so each non-contiguous run requires its own extent record. When the value root's extent list is full and meta ac is NULL, ocfs2 add clusters in btree() returns RESTART META, and ocfs2 xattr extend allocation() hits BUG ON(why == RESTART META).

[FIX] The case where no xattr block exists yet already calls ocfs2 extend meta needed(&def xv.xv.xr list) to reserve value tree metadata. Add the same reservation to the case where an xattr block already exists, making the two cases consistent.

Replace the BUG ON with a -ENOSPC return so that if RESTART META is returned despite the reservation, the error propagates to userspace instead of panicking the kernel.