CVE-2026-90320

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the ocfs2 module where the ocfs2 validate xattr block() function fails to verify that xh count and entry offsets for non-indexed blocks fit within the block. Additionally, indexed buckets are passed to consumers without an entry-bounds check. This allows corrupted external xattr metadata to cause out-of-range access during the execution of listxattr() or getxattr(), potentially leading to a use-after-free condition in the ocfs2 xattr list entries() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.