Executive brief
The OCFS2 filesystem driver in the Linux kernel contains a validation flaw in its trim operation (used to discard unused storage blocks). When a filesystem uses a cluster size larger than the block size, an attacker or user can provide a specially crafted trim request that bypasses range checks, causing integer underflow arithmetic that trims storage far beyond the requested range. This could lead to data loss or filesystem corruption on affected systems.
Technical details
The vulnerability exists in the ocfs2_trim_mainbm() function in fs/ocfs2/alloc.c. The function validates FITRIM (filesystem trim) range requests by checking if the range length is less than s_blocksize, but on filesystems where cluster size exceeds block size, this check is insufficient. A range between one block and one cluster in length is accepted and later undergoes arithmetic operations (start + len - 1 and len -= ...) that underflow when len is shifted down to zero, causing trimming to proceed past the requested range. The fix changes the validation check from sb->s_blocksize to osb->s_clustersize. No authentication or special privileges appear required to trigger this via the FITRIM ioctl interface.
Affected products
- Linux Linux kernel Linux 2.6.11 through 7.2 and rolling branches (OCFS2 subsystem)
Timeline
- 2026-08-15: disclosed: Published in NVD
- 2026-07-24: patched: Patch committed to stable kernel tree