In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent [BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write. [CAUSE] When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root back to leaf mode with a bulk memset on &rb->rf_records. rf_records sits in an anonymous union with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count, and is 0 for a single-level tree. With rl_count equal to 0, the memset writes past the 16-byte declared size of rf_records, which the fortify checker catches. [FIX] Replace the bulk memset on &rb->rf_records with a correctly-bounded memset on rl_recs[] alone, after setting rl_count to the correct value.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-80638 is a critical out-of-bounds write vulnerability in the Linux kernel's OCFS2 (Oracle Cluster File System 2) subsystem. When unlinking a refcounted file whose refcount tree has leaf blocks, the ocfs2_remove_refcount_extent() function performs an unsafe bulk memset operation on the rf_records field. Due to improper union handling between rf_records and rf_list.l_tree_d, this memset writes beyond allocated buffer boundaries, causing kernel panics and potential memory corruption. This affects Linux systems running OCFS2, particularly in clustered storage environments where refcounting is actively used. The vulnerability has a CVSS score of 8.8, indicating high severity with potential for denial of service and privilege escalation.
Casky's Claude-powered analysis would identify this vulnerability through detection of unsafe memory operations and type confusion patterns associated with MITRE ATT&CK technique T1499 (Resource Exhaustion) and T1561 (Disk Wipe/Destruction). While no MITRE techniques are formally mapped to this CVE, practitioners using Casky would observe findings related to memory safety violations, improper buffer management, and union-based type confusion. The platform's extended reasoning capabilities would flag the unsafe memset patterns on nested data structures and the logic flaw in the union field overlap, enabling security teams to identify similar kernel memory corruption risks across their infrastructure before exploitation occurs.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-80638. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation