CVE-2026-53039

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate group add input before caching

[BUG] OCFS2IOCGROUPADD can trigger a BUGON in ocfs2setnewbufferuptodate():

kernel BUG at fs/ocfs2/uptodate.c:509! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI RIP: 0010:ocfs2setnewbufferuptodate+0x194/0x1e0 fs/ocfs2/uptodate.c:509 Code: ffffe88f 42b9fe4c 89e64889 dfe8b4df Call Trace: ocfs2groupadd+0x3f1/0x1510 fs/ocfs2/resize.c:507 ocfs2ioctl+0x309/0x6e0 fs/ocfs2/ioctl.c:887 vfsioctl fs/ioctl.c:51 [inline] __dosysioctl fs/ioctl.c:597 [inline] __sesysioctl fs/ioctl.c:583 [inline] _x64sysioctl+0x197/0x1e0 fs/ioctl.c:583 x64syscall+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls64.h:17 dosyscallx64 arch/x86/entry/syscall64.c:63 [inline] dosyscall64+0x93/0xf80 arch/x86/entry/syscall64.c:94 entrySYSCALL64afterhwframe+0x76/0x7e RIP: 0033:0x7bbfb55a966d

[CAUSE] ocfs2groupadd() calls ocfs2setnewbufferuptodate() on a user-controlled group block before ocfs2verifygroupandinput() validates that block number. That helper is only valid for newly allocated metadata and asserts that the block is not already present in the chosen metadata cache. The code also uses INODECACHE(inode) even though the group descriptor belongs to mainbm_inode and later journal accesses use that cache context instead.

[FIX] Validate the on-disk group descriptor before caching it, then add it to the metadata cache tracked by INODECACHE(mainbm_inode). Keep the validation failure path separate from the later cleanup path so we only remove the buffer from that cache after it has actually been inserted. This keeps the group buffer lifetime consistent across validation, journaling, and cleanup.