{
  "cveId": "CVE-2026-90321",
  "url": "https://patchblox.com/security/cve/CVE-2026-90321",
  "summary": "CVE-2026-90321 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-90321, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ocfs2: validate inline xattrs during inode block validation",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate inline xattrs during inode block validation  Patch series \u0022ocfs2: validate xattr entry bounds\u0022, v7.  This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxattr() or listxattr() can walk out-of-range entry arrays or offsets from corrupted metadata.   This patch (of 2):  ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk metadata from it, but inline xattr metadata is still checked only in operation-specific consumers.  The existing ibody lookup helper validates inline header placement and entry count, but inode block validation does not reject entry name/value bounds.  Add a flat xattr entry validator and call it from inode block validation for inline xattrs.  Keep the operation paths on their existing header/count lookup checks; the full entry bounds check now runs when the inode block is validated at read time.  Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or listxattr() can walk past the inline storage.  Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_find_entry\u002B0x5a/0x170 Read of size 2 at addr ffff8881242a2000 by task python3/529 Call Trace:   dump_stack_lvl\u002B0x66/0xa0   print_report\u002B0xce/0x630   kasan_report\u002B0xe0/0x110   ocfs2_xattr_find_entry\u002B0x5a/0x170   ocfs2_xattr_get_nolock\u002B0x20a/0x820   ocfs2_xattr_get\u002B0x10c/0x1e0   __vfs_getxattr\u002B0xe2/0x130   vfs_getxattr\u002B0x185/0x1b0",
  "published": "2026-09-17T17:17:30Z",
  "severity": "Important",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
  "epss": 0.00181,
  "epssPercentile": 0.07726,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90321",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-90321",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90321",
      "released": "2026-09-23T19:19:02Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.6-1",
      "fix": "DEBIAN-CVE-2026-90321",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-90321",
      "released": "2026-09-23T19:19:02Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T19:38:12Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}