Junglewise Threat Intelligence

CVE-2026-72161: Linux kernel OCFS2 NULL pointer dereference in ocfs2_checkpoint_inode

CVE-2026-72161 · Severity: info · Published 2026-08-15

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

OCFS2 is a distributed filesystem used in Oracle clusters. During system shutdown, a race condition causes the kernel to attempt accessing the journal after it has been freed, resulting in a crash. This can lead to system instability or denial of service during unmount operations.

Technical details

A NULL pointer dereference occurs in the OCFS2 filesystem's ocfs2_checkpoint_inode() function during unmount. The vulnerability arises when ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL, but the VFS layer subsequently evicts cached inodes via ocfs2_evict_inode() → ocfs2_clear_inode() → ocfs2_checkpoint_inode() → ocfs2_ci_fully_checkpointed(), which dereferences the now-NULL osb->journal pointer. The fix adds a NULL check for osb->journal before dereferencing it; if the journal is NULL, the function returns early since the journal has already been fully flushed during shutdown. This is a local vulnerability triggered during normal filesystem unmount operations, patched in the Linux kernel stable tree.

Affected products

  • Linux Linux kernel Multiple versions up to at least 6.18

Timeline

  • 2026-08-15: disclosed
  • 2026-05-31: patched: Fix committed upstream
  • 2026-07-24: other: Backported to stable kernels

References

Related threats