Executive brief
A vulnerability in the Linux kernel's OCFS2 file system driver could allow a local user to cause a system crash or potentially execute unauthorized actions. The issue occurs when the system processes a specially crafted or corrupted file system image, leading to memory corruption. This could impact the stability of servers using this specific file system or allow for a local escalation of privilege.
Technical details
An out-of-bounds write vulnerability exists in the Linux kernel's OCFS2 file system implementation. The root cause is that the 'ocfs2_try_to_write_inline_data' function relies on the on-disk 'id_count' field without sufficient validation. On a corrupted or malicious filesystem, this field can exceed the physical maximum inline data capacity, causing a 'memcpy_from_folio' operation to overflow the inode block buffer into adjacent memory. This was initially reported by KASAN as a use-after-free but was identified as an OOB write. An attacker with the ability to mount a crafted OCFS2 image (e.g., via a loop device) could trigger this flaw to cause a kernel panic or achieve local privilege escalation. The fix introduces an upper-bound check for 'id_count' in 'ocfs2_validate_inode_block()'.
Affected products
- Linux Linux kernel 2.6.24 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0-rc1 to 7.0-rc7
Timeline
- 2026-04-03: disclosed: Initial patch submission by Joseph Qi
- 2026-05-06: advisory: CVE-2026-43075 published by kernel.org
- 2026-05-20: patched: NVD analysis and CPE configurations updated
References
- https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9
- https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604
- https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14
- https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9
- https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f