CVE-2026-53041

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix listxattr handling when the buffer is full

[BUG]

If an OCFS2 inode has both inline and block-based xattrs, listxattr()

can return a size larger than the caller's buffer when the inline names

consume that buffer exactly.

kernel BUG at mm/usercopy.c:102!

Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI

RIP: 0010:usercopy_abort+0xb7/0xd0 mm/usercopy.c:102

Call Trace:

__check_heap_object+0xe3/0x120 mm/slub.c:8243

check_heap_object mm/usercopy.c:196 [inline]

__check_object_size mm/usercopy.c:250 [inline]

__check_object_size+0x5c5/0x780 mm/usercopy.c:215

check_object_size include/linux/ucopysize.h:22 [inline]

check_copy_size include/linux/ucopysize.h:59 [inline]

copy_to_user include/linux/uaccess.h:219 [inline]

listxattr+0xb0/0x170 fs/xattr.c:926

filename_listxattr fs/xattr.c:958 [inline]

path_listxattrat+0x137/0x320 fs/xattr.c:988

__do_sys_listxattr fs/xattr.c:1001 [inline]

__se_sys_listxattr fs/xat

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References