Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-80881— ocfs2: fix buffer head management in ocfs2_read_blocks()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ocfs2_read_blocks()中对buffer head管理不当，可能导致验证失败的buffer head被错误重用并插入OCFS2元数据缓存，造成数据不一致。

AI Predicted 7.5 Difficulty: Hard EPSS 0.22% · P12

Possible ATT&CK Techniques 1 AI

T1079

Affected Version Matrix 26

VendorProduct Version RangeStatus
Linux Linux cf76c78595ca87548ca5e45c862ac9e0949c4687< a4eae1499c760949a93459d11390bd1fd823d31d affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 4ab17e328522a4df5fe0f0dcf39098118b1feeaa affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 5927acb3e2c99985a14adecd9d1b67ba191c622d affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< ecb3f9386f4353034caef77239473c627232db17 affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 61f7a5acb3bf8fc97dad78f54b1e8d0e1c819766 affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 0e389fc290c350c67591abf4c367119f4689f310 affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 9e7a057934cdd58e4cc94350bcfe5367bbee0f8e affected
cf76c78595ca87548ca5e45c862ac9e0949c4687< 6371a07148ee979af22a9d6f4c277462953a9a4a affected
… +18 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-80881

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
ocfs2: fix buffer head management in ocfs2_read_blocks()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix buffer head management in ocfs2_read_blocks() In ocfs2_read_blocks(), caller should't assume that buffer head returned by 'sb_getblk()' is exclusively owned and so 'put_bh()' always drops b_count from 1 to 0. If it is not so, buffer head remains on hold and likely to be returned by the next call to 'sb_getblk()' unchanged - that is, with BH_Uptodate bit set even if it has failed validation previously, thus allowing to insert that buffer head into OCFS2 metadata cache and submit it to upper layers. To avoid such a scenario, BH_Uptodate should be cleared immediately after 'validate()' callback has detected some data inconsistency.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的一个操作系统内核。 Linux kernel存在安全漏洞，该漏洞源于ocfs2_read_blocks()中对buffer head管理不当，可能导致验证失败的buffer head被错误重用并插入OCFS2元数据缓存，造成数据不一致。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux cf76c78595ca87548ca5e45c862ac9e0949c4687 ~ a4eae1499c760949a93459d11390bd1fd823d31d -
Linux Linux 4.20 -

II. Public POCs for CVE-2026-80881

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-80881

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-80881 (8)

Same Patch Batch · Linux · 2026-09-04 · 156 CVEs total

CVE-2026-80864 RDMA/rxe: Fix responder UAF on IB_QP_MAX_DEST_RD_ATOMIC modify_qp
CVE-2026-80855 fuse: fix invalidate lock leak on open O_TRUNC DAX failure
CVE-2026-80856 fuse: fix invalidate lock leak on setattr writeback failure
CVE-2026-80857 fuse: wait for FR_FINISHED on abort_on_kill to prevent use-after-free
CVE-2026-80858 fuse: publish io-uring queues with release semantics
CVE-2026-80859 fuse: fix missing barrier when checking io-uring readiness
CVE-2026-80860 fuse: fix race between interrupt and resend
CVE-2026-80861 usb: xhci: bail out of setup if the controller is inaccessible
CVE-2026-80862 nvme-tcp: fix usage of page_frag_cache
CVE-2026-80863 RDMA/rxe: Fix OOB in free_rd_atomic_resources()
CVE-2026-80869 ntfs: bound the attribute-list entry in ntfs_read_inode_mount()
CVE-2026-80873 KVM: arm64: nv: Write ESR_EL2 for injected nested SError exceptions
CVE-2026-80872 ALSA: hda/tas2781: Cancel async firmware request at unbind
CVE-2026-80871 crypto: xilinx-trng - Remove crypto_rng interface
CVE-2026-80870 drm/amdkfd: Validate CRIU-restored IDs before idr_alloc
CVE-2026-80867 alpha/PCI: Add security_locked_down() check to pci_mmap_resource()
CVE-2026-80865 bpf: Add missing access_ok call to copy_user_syms
CVE-2026-80866 tipc: avoid busy looping in tipc_exit_net()
CVE-2026-80854 usb: gadget: f_tcm: keep port count until LUN teardown completes
CVE-2026-80868 ntfs3: Allocate iomap inline_data using alloc_page

Showing top 20 of 156 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-80881

No comments yet

Leave a comment