---
id: CVE-2026-80644
title: 'ocfs2: don''t BUG_ON an invalid journal dinode'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: don't BUG_ON an invalid journal dinode

  [BUG]
  A fuzzed OCFS2 image can corrupt the current slot journal dinode while
  mount is still in progress. The mount path f…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    bf1d59cf2ac8a1730607ebaa0bc0dc6d00f197d0
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    86509c5296fe46ad6bcdd83931a53c2c6b7913a8
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    12c32a7350b670aaaaf2e01583d8648ec0c9755c
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    b460f8d01a12061853d02c8fb693fb42450acd7d
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    a06eec15596e5801bad59ad16cd2bf4f0fa839a1
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    3852478d34c7baa490ba9c7374ee901a56eea577
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    5b33f99f3e48465bd93219495381a5aef4fa967f
  - >-
    Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 <
    c0438198c28b1d22c272751af5e717c11d9fa8dd
  - Linux 2.6.29
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T17:02:21.588154Z'
published: '2026-08-28'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T17:05:52.371Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-80644'
references:
  - url: 'https://git.kernel.org/stable/c/bf1d59cf2ac8a1730607ebaa0bc0dc6d00f197d0'
  - url: 'https://git.kernel.org/stable/c/86509c5296fe46ad6bcdd83931a53c2c6b7913a8'
  - url: 'https://git.kernel.org/stable/c/12c32a7350b670aaaaf2e01583d8648ec0c9755c'
  - url: 'https://git.kernel.org/stable/c/b460f8d01a12061853d02c8fb693fb42450acd7d'
  - url: 'https://git.kernel.org/stable/c/a06eec15596e5801bad59ad16cd2bf4f0fa839a1'
  - url: 'https://git.kernel.org/stable/c/3852478d34c7baa490ba9c7374ee901a56eea577'
  - url: 'https://git.kernel.org/stable/c/5b33f99f3e48465bd93219495381a5aef4fa967f'
  - url: 'https://git.kernel.org/stable/c/c0438198c28b1d22c272751af5e717c11d9fa8dd'
tags:
  - cve.org
epss: 0.0022
epssPercentile: 0.12543
ingestedAt: '2026-11-06T18:00:12.537Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: don't BUG_ON an invalid journal dinode

[BUG]
A fuzzed OCFS2 image can corrupt the current slot journal dinode while
mount is still in progress. The mount path first reports the invalid
journal block and then crashes in shutdown:

kernel BUG at fs/ocfs2/journal.c:1034!
Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:ocfs2_journal_toggle_dirty+0x2d6/0x340 fs/ocfs2/journal.c:1034
Call Trace:
 ocfs2_journal_shutdown+0x414/0xc30 fs/ocfs2/journal.c:1116
 ocfs2_mount_volume fs/ocfs2/super.c:1785 [inline]
 ocfs2_fill_super+0x30a9/0x3cd0 fs/ocfs2/super.c:1083
 get_tree_bdev_flags+0x38b/0x640 fs/super.c:1698
 get_tree_bdev+0x24/0x40 fs/super.c:1721
 ocfs2_get_tree+0x21/0x30 fs/ocfs2/super.c:1184
 vfs_get_tree+0x9a/0x370 fs/super.c:1758
 fc_mount fs/namespace.c:1199 [inline]
 do_new_mount_fc fs/namespace.c:3642 [inline]
 do_new_mount fs/namespace.c:3718 [inline]
 path_mount+0x5b8/0x1ea0 fs/namespace.c:4028
 do_mount fs/namespace.c:4041 [inline]
 __do_sys_mount fs/namespace.c:4229 [inline]
 __se_sys_mount fs/namespace.c:4206 [inline]
 __x64_sys_mount+0x282/0x320 fs/namespace.c:4206
 ...

[CAUSE]
ocfs2_journal_toggle_dirty() used to return -EIO when journal->j_bh no
longer contained a valid dinode, because the startup and shutdown paths
already handled that failure. Commit 10995aa2451a
("ocfs2: Morph the haphazard OCFS2_IS_VALID_DINODE() checks.") changed
the check to a BUG_ON() under the assumption that the journal dinode had
already been validated. That turns an unexpected invalid journal dinode
during mount teardown into a kernel crash instead of a normal mount
failure.

[FIX]
Replace the BUG_ON() with WARN_ON() and return -EIO. This keeps the
invariant warning for debugging, but restores the original behavior of
failing startup or shutdown cleanly instead of panicking the kernel.

## Affected

- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < bf1d59cf2ac8a1730607ebaa0bc0dc6d00f197d0`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < 86509c5296fe46ad6bcdd83931a53c2c6b7913a8`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < 12c32a7350b670aaaaf2e01583d8648ec0c9755c`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < b460f8d01a12061853d02c8fb693fb42450acd7d`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < a06eec15596e5801bad59ad16cd2bf4f0fa839a1`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < 3852478d34c7baa490ba9c7374ee901a56eea577`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < 5b33f99f3e48465bd93219495381a5aef4fa967f`
- `Linux >= 10995aa2451afa20b721cc7de856cae1a13dba57 < c0438198c28b1d22c272751af5e717c11d9fa8dd`
- `Linux 2.6.29`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.