Executive brief
A vulnerability exists in the Linux kernel's OCFS2 file system, which is used for managing shared storage in clusters. If a user is tricked into mounting or accessing a specially crafted, corrupted disk image, the system may crash or allow unauthorized access to memory. This could lead to a total system failure or the potential theft of sensitive data.
Technical details
A use-after-free (UAF) vulnerability exists in the OCFS2 file system component of the Linux kernel. The root cause is a lack of validation for the 'i_size' field against the 'id_count' capacity when reading an inode with inline data in 'ocfs2_validate_inode_block()'. An attacker can provide a corrupted filesystem where 'i_size' exceeds the actual inline data buffer, causing 'ocfs2_dir_foreach_blk_id()' to iterate into out-of-bounds or freed memory. This can be triggered during directory entry checks, leading to a kernel crash or arbitrary code execution. Patches have been released for multiple stable kernel branches.
Affected products
- Linux Linux kernel 2.6.24 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14
Timeline
- 2026-05-06: advisory: Initial disclosure of CVE-2026-43076
- 2026-01-20: patched: Mainline patch committed by Andrew Morton
References
- https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f
- https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63
- https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc
- https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b
- https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39