# CVE-2026-90321: ocfs2: validate inline xattrs during inode block validation

CVE-2026-90321 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-90321, released September 23, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-90321
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Sep 17, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-90321

## Description

In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate inline xattrs during inode block validation  Patch series "ocfs2: validate xattr entry bounds", v7.  This series validates OCFS2 xattr entry name/value bounds when xattr metadata is read and validated, before getxattr() or listxattr() can walk out-of-range entry arrays or offsets from corrupted metadata.   This patch (of 2):  ocfs2_validate_inode_block() verifies a dinode before OCFS2 users walk metadata from it, but inline xattr metadata is still checked only in operation-specific consumers.  The existing ibody lookup helper validates inline header placement and entry count, but inode block validation does not reject entry name/value bounds.  Add a flat xattr entry validator and call it from inode block validation for inline xattrs.  Keep the operation paths on their existing header/count lookup checks; the full entry bounds check now runs when the inode block is validated at read time.  Reject corrupted inline xattr metadata before ocfs2_xattr_ibody_get() or listxattr() can walk past the inline storage.  Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_find_entry+0x5a/0x170 Read of size 2 at addr ffff8881242a2000 by task python3/529 Call Trace:   dump_stack_lvl+0x66/0xa0   print_report+0xce/0x630   kasan_report+0xe0/0x110   ocfs2_xattr_find_entry+0x5a/0x170   ocfs2_xattr_get_nolock+0x20a/0x820   ocfs2_xattr_get+0x10c/0x1e0   __vfs_getxattr+0xe2/0x130   vfs_getxattr+0x185/0x1b0

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-90321](https://patchblox.com/security/data/fix/linux/debian-cve-2026-90321.md) | Sep 23, 2026 |
| Linux | linux Debian 14 | 7.2.6-1 | [DEBIAN-CVE-2026-90321](https://patchblox.com/security/data/fix/linux/debian-cve-2026-90321.md) | Sep 23, 2026 |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.