Executive brief
OCFS2 is a clustered file system used in Linux environments. A direct write operation can crash the kernel when the journal aborts (due to I/O errors), causing a NULL pointer dereference and kernel panic. This affects systems using OCFS2 storage with direct I/O workloads and can result in service unavailability.
Technical details
This is a NULL pointer dereference vulnerability in the ocfs2_assure_trans_credits() function within the Linux kernel's OCFS2 file system. When a direct write operation over unwritten extents encounters a journal abort (e.g., due to I/O errors), the journal handle's transaction pointer is cleared. The vulnerable function then attempts to dereference this NULL pointer when checking remaining transaction credits without first verifying the handle's abort status. The fix adds an explicit check via is_handle_aborted() before accessing the transaction pointer, returning -EROFS when an abort is detected. No remote attack vector exists; the vulnerability is triggered through legitimate file system operations during error conditions.
Affected products
- Linux Linux kernel Multiple stable versions (linux-4.x through linux-7.x and earlier)
Timeline
- 2026-08-15: disclosed: CVE-2026-72163 published
- 2026-07-24: patched: Fix committed to stable kernel branches