Executive brief
A vulnerability in the Linux kernel's OCFS2 file system component could allow a local user to crash the system. By using a specially crafted file system image and specific diagnostic commands, an attacker can trigger an out-of-bounds memory access. This results in a system crash (kernel panic), impacting the availability of the server.
Technical details
A vulnerability exists in the OCFS2 file system's ioctl handler, specifically within the freefrag scan functionality. When OCFS2_IOC_INFO is issued with the OCFS2_INFO_FL_NON_COHERENT flag, the function ocfs2_info_freefrag_scan_chain() uses the on-disk 'bg_bits' value directly as a bitmap scan limit without proper validation. Because the non-coherent path uses ocfs2_read_blocks_sync() instead of the standard validated reader, a crafted filesystem can provide an impossible bg_bits value, leading to an out-of-bounds bitmap walk and a use-after-free condition. This can be exploited by a local user with permissions to mount or interact with a crafted OCFS2 volume to cause a denial of service. Patches have been released for various stable kernel branches to clamp the scan to the computed bitmap capacity.
Affected products
- Linux Linux Kernel ocfs2 module
Timeline
- 2026-04-10: disclosed: Initial patch submission
- 2026-05-23: patched: Patch committed to stable tree
- 2026-06-24: advisory: CVE published
References
- https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e
- https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8
- https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8
- https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2
- https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b
- https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07
- https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8