In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller should't assume that buffer head returned by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops b_count from 1 to 0. If it is not so, buffer head remains on hold and likely to be returned by the next call to 'sb_getblk()' unchanged - that is, with BH_Uptodate bit set even if it has failed validation previously, thus allowing to insert that buffer head into OCFS2 metadata cache and submit it to upper layers. To avoid such a scenario, BH_Uptodate should be cleared immediately after 'validate()' callback has detected some data inconsistency.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Linux
  • Linux Kernel

No data.

No data.

References
Link Providers
https://git.kernel.org/stable/c/0e389fc290c350c67591abf4c367119f4689f310 cve-icon cve-icon
https://git.kernel.org/stable/c/4ab17e328522a4df5fe0f0dcf39098118b1feeaa cve-icon cve-icon
https://git.kernel.org/stable/c/5927acb3e2c99985a14adecd9d1b67ba191c622d cve-icon cve-icon
https://git.kernel.org/stable/c/61f7a5acb3bf8fc97dad78f54b1e8d0e1c819766 cve-icon cve-icon
https://git.kernel.org/stable/c/6371a07148ee979af22a9d6f4c277462953a9a4a cve-icon cve-icon
https://git.kernel.org/stable/c/9e7a057934cdd58e4cc94350bcfe5367bbee0f8e cve-icon cve-icon
https://git.kernel.org/stable/c/a4eae1499c760949a93459d11390bd1fd823d31d cve-icon cve-icon
https://git.kernel.org/stable/c/ecb3f9386f4353034caef77239473c627232db17 cve-icon cve-icon
History

Fri, 04 Sep 2026 21:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-665
CWE-775

Fri, 04 Sep 2026 17:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller should't assume that buffer head returned by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops b_count from 1 to 0. If it is not so, buffer head remains on hold and likely to be returned by the next call to 'sb_getblk()' unchanged - that is, with BH_Uptodate bit set even if it has failed validation previously, thus allowing to insert that buffer head into OCFS2 metadata cache and submit it to upper layers. To avoid such a scenario, BH_Uptodate should be cleared immediately after 'validate()' callback has detected some data inconsistency.
Title ocfs2: fix buffer head management in ocfs2_read_blocks()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-04T16:49:11.758Z

Updated: 2026-09-04T16:49:11.758Z

Reserved: 2026-08-26T14:34:25.799Z

Link: CVE-2026-80881

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-04T17:17:00.390

Modified: 2026-09-04T17:17:00.390

Link: CVE-2026-80881

cve-icon Redhat

No data.