In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix NULL pointer dereference in ocfs2_journal_dirty()
bdev->bd_super has been removed and commit 8887b94d9322 change the usage from bdev->bd_super to b_assoc_map->host->i_sb. This introduces the following NULL pointer dereference in ocfs2_journal_dirty() since b_assoc_map is still not initialized. This can be easily reproduced by running xfstests generic/186, which simulate no more credits.
[ 134.351592] BUG: kernel NULL pointer dereference, address: 0000000000000000 ... [ 134.355341] RIP: 0010:ocfs2_journal_dirty+0x14f/0x160 [ocfs2] ... [ 134.365071] Call Trace: [ 134.365312] <TASK> [ 134.365524] ? __die_body+0x1e/0x60 [ 134.365868] ? page_fault_oops+0x13d/0x4f0 [ 134.366265] ? __pfx_bit_wait_io+0x10/0x10 [ 134.366659] ? schedule+0x27/0xb0 [ 134.366981] ? exc_page_fault+0x6a/0x140 [ 134.367356] ? asm_exc_page_fault+0x26/0x30 [ 134.367762] ? ocfs2_journal_dirty+0x14f/0x160 [ocfs2] [ 134.368305] ? ocfs2_journal_dirty+0x13d/0x160 [ocfs2] [ 134.368837] ocfs2_create_new_meta_bhs.isra.51+0x139/0x2e0 [ocfs2] [ 134.369454] ocfs2_grow_tree+0x688/0x8a0 [ocfs2] [ 134.369927] ocfs2_split_and_insert.isra.67+0x35c/0x4a0 [ocfs2] [ 134.370521] ocfs2_split_extent+0x314/0x4d0 [ocfs2] [ 134.371019] ocfs2_change_extent_flag+0x174/0x410 [ocfs2] [ 134.371566] ocfs2_add_refcount_flag+0x3fa/0x630 [ocfs2] [ 134.372117] ocfs2_reflink_remap_extent+0x21b/0x4c0 [ocfs2] [ 134.372994] ? inode_update_timestamps+0x4a/0x120 [ 134.373692] ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2] [ 134.374545] ? __pfx_ocfs2_journal_access_di+0x10/0x10 [ocfs2] [ 134.375393] ocfs2_reflink_remap_blocks+0xe4/0x4e0 [ocfs2] [ 134.376197] ocfs2_remap_file_range+0x1de/0x390 [ocfs2] [ 134.376971] ? security_file_permission+0x29/0x50 [ 134.377644] vfs_clone_file_range+0xfe/0x320 [ 134.378268] ioctl_file_clone+0x45/0xa0 [ 134.378853] do_vfs_ioctl+0x457/0x990 [ 134.379422] __x64_sys_ioctl+0x6e/0xd0 [ 134.379987] do_syscall_64+0x5d/0x170 [ 134.380550] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 134.381231] RIP: 0033:0x7fa4926397cb [ 134.381786] Code: 73 01 c3 48 8b 0d bd 56 38 00 f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa b8 10 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 8b 0d 8d 56 38 00 f7 d8 64 89 01 48 [ 134.383930] RSP: 002b:00007ffc2b39f7b8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 134.384854] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00007fa4926397cb [ 134.385734] RDX: 00007ffc2b39f7f0 RSI: 000000004020940d RDI: 0000000000000003 [ 134.386606] RBP: 0000000000000000 R08: 00111a82a4f015bb R09: 00007fa494221000 [ 134.387476] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 134.388342] R13: 0000000000f10000 R14: 0000558e844e2ac8 R15: 0000000000f10000 [ 134.389207] </TASK>
Fix it by only aborting transaction and journal in ocfs2_journal_dirty() now, and leave ocfs2_abort() later when detecting an aborted handle, e.g. start next transaction. Also log the handle details in this case.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 27, 2026 | Jul 27, 2026 |
| Ubuntu | — | Upgrade linux-image-lowlatency-hwe-22.04Upgrade linux-image-nvidiaUpgrade linux-image-azureUpgrade linux-image-raspiUpgrade linux-image-oem-22.04Upgrade linux-image-nvidia-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1012-ibmUpgrade linux-image-lowlatency-64kUpgrade linux-image-generic-lpaeUpgrade linux-image-nvidia-6.8Upgrade linux-image-genericUpgrade linux-image-generic-64k-hwe-22.04Upgrade linux-image-nvidia-64k-6.8Upgrade linux-image-6.8.0-1012-oracleUpgrade linux-image-6.8.0-1015-awsUpgrade linux-image-6.8.0-1013-nvidia-lowlatencyUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-1013-nvidiaUpgrade linux-image-6.8.0-44-lowlatency-64kUpgrade linux-image-6.8.0-45-generic-64kUpgrade linux-image-oem-22.04dUpgrade linux-image-6.8.0-44-lowlatencyUpgrade linux-image-nvidia-lowlatencyUpgrade linux-image-6.8.0-1014-azure-fdeUpgrade linux-image-6.8.0-1011-raspiUpgrade linux-image-6.8.0-1014-gcpUpgrade linux-image-generic-hwe-22.04Upgrade linux-image-azure-fdeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-kvmUpgrade linux-image-virtual-hwe-22.04Upgrade linux-image-6.8.0-44-genericUpgrade linux-image-lowlatency-64k-hwe-22.04Upgrade linux-image-ibm-lts-24.04Upgrade linux-image-gcpUpgrade linux-image-6.8.0-1010-gkeUpgrade linux-image-6.8.0-1013-nvidia-lowlatency-64kUpgrade linux-image-6.8.0-1012-oemUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1014-azureUpgrade linux-image-6.8.0-44-generic-64kUpgrade linux-image-awsUpgrade linux-image-lowlatencyUpgrade linux-image-ibmUpgrade linux-image-oem-22.04bUpgrade linux-image-virtualUpgrade linux-image-oem-22.04cUpgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-6.8.0-1013-nvidia-64kUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-ibm-classicUpgrade linux-image-6.8.0-1012-oracle-64kUpgrade linux-image-oracleUpgrade linux-image-oem-22.04aUpgrade linux-image-nvidia-64kUpgrade linux-image-6.8.0-45-generic | Sep 12, 2024 | Jul 12, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub