Executive brief
The Linux kernel's OCFS2 filesystem contains a bug in its extent relocation code that allows data to be written to disk clusters that are still in use by other files. When users request moving file extents to specific cluster locations, the code can incorrectly target occupied clusters, leading to data corruption and potential data loss affecting files stored on OCFS2 volumes.
Technical details
The vulnerability exists in the ocfs2_probe_alloc_group() function in fs/ocfs2/move_extents.c, which is responsible for finding free disk clusters for file extent relocation. When handling non-automatic OCFS2_IOC_MOVE_EXT operations, the probe function fails to properly validate that a user-supplied goal cluster is actually free; if a scan reaches the end of a cluster group without finding a free run, it leaves the occupied goal unchanged. Additionally, the calculation for free-run starting positions was off by one. An attacker or malicious user can supply a physical cluster goal targeting an occupied cluster, causing __ocfs2_move_extent() to copy file data into clusters owned by another inode before the bitmap is updated. The attack requires local access to call OCFS2_IOC_MOVE_EXT ioctl. The fix clears the cluster position before scanning and corrects the free-run calculation formula.
Affected products
- Linux Linux kernel Multiple kernel versions (OCFS2 filesystem support, patched in stable series)
Timeline
- 2026-08-15: disclosed: CVE-2026-72164 published
- 2026-07-24: patched: Fix committed to Linux kernel stable trees by Greg Kroah-Hartman