CVE-2026-80638

CVE-2026-80638 is an out-of-bounds write in the ocfs2 filesystem's refcount code in the Linux kernel. It is triggered when the last leaf block is removed from a refcount tree (for example, while unlinking a refcounted file): ocfs2_remove_refcount_extent() performs a bulk memset over rf_records while the aliased rl_count field is 0, causing writes past the 16-byte declared size of the structure, which the kernel's fortify checks catch as a panic. An attacker who can create and delete refcounted files on a mounted ocfs2 volume could corrupt adjacent kernel memory; the CVSS 3.1 score of 8.8 (High) reflects high confidentiality, integrity, and availability impact, and the observed symptom in the fix report is a fortify panic (kernel crash). Only systems running Linux kernels with ocfs2 mounted and using refcounted files whose refcount trees have leaf blocks are affected; most Linux installations never mount this clustered filesystem. There is no known exploitation: the flaw is not in CISA KEV, no public proof-of-concept exists, and EPSS estimates only a 0.3% probability of exploitation within 30 days.

What to do: Track your distribution's kernel updates and install a release containing the ocfs2 fix (bounded memset on rl_recs[] after setting rl_count) once published; no fixed version number is available in the data yet. To assess exposure, check whether ocfs2 is in use (e.g., 'mount | grep ocfs2') and whether any volumes use the refcount feature; systems without ocfs2 mounted are unaffected. As an interim measure, avoid unlinking refcounted ocfs2 files with multi-level refcount trees, or unmount ocfs2 volumes if they are not required.