CVE-2026-80881

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix buffer head management in ocfs2_read_blocks()

In ocfs2_read_blocks(), caller should't assume that buffer head returned

by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops

b_count from 1 to 0. If it is not so, buffer head remains on hold and

likely to be returned by the next call to 'sb_getblk()' unchanged - that

is, with BH_Uptodate bit set even if it has failed validation previously,

thus allowing to insert that buffer head into OCFS2 metadata cache and

submit it to upper layers. To avoid such a scenario, BH_Uptodate should

be cleared immediately after 'validate()' callback has detected some data

inconsistency.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References