{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate external xattr entries when reading metadata  ocfs2_validate_xattr_block() checks the xattr block header before the block reaches higher-level xattr users, but it does not verify that a non-indexed block's xh_count and entry offsets fit inside the block.  Indexed buckets likewise reach list/get consumers after ECC without an entry-bounds check.  Use the flat xattr entry validator for non-indexed external xattr blocks, and use a bucket-specific validator for indexed buckets at metadata read time.  The bucket validator keeps the entry array bounded by the first bucket block while checking name/value offsets against the bucket block they target.  Reject corrupted external xattr metadata before listxattr() or getxattr() can walk out-of-range entry arrays or name/value offsets.  Validation reproduced this kernel report: BUG: KASAN: use-after-free in ocfs2_xattr_list_entries+0xd7/0x190 Read of size 1 at addr ffff88810a654007 by task ocfs2_xattr_lis/630 Call Trace:   dump_stack_lvl+0x66/0xa0   print_report+0xce/0x630   kasan_report+0xe0/0x110   ocfs2_xattr_list_entries+0xd7/0x190   ocfs2_listxattr+0x3f6/0x610   listxattr+0x90/0xe0   path_listxattrat+0xed/0x220   do_syscall_64+0x115/0x6a0   entry_SYSCALL_64_after_hwframe+0x77/0x7f",
  "id": "DEBIAN-CVE-2026-90320",
  "modified": "2026-09-18T04:47:23.729346108Z",
  "published": "2026-09-17T17:17:29.957Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90320"
    }
  ],
  "upstream": [
    "CVE-2026-90320"
  ]
}