Executive brief
OCFS2 is a filesystem used for distributed storage in cluster environments. On 32-bit Linux kernels, a bug in the directory reading code causes the read position to reset after reaching 4 GB, causing applications to see duplicate directory entries repeatedly. This can lead to applications hanging indefinitely or behaving unpredictably when enumerating large directories.
Technical details
The vulnerability is an integer truncation bug in the ocfs2_dir_foreach_blk_el() function. On 32-bit kernels, when computing the directory position mask using the expression (ctx->pos & ~(sb->s_blocksize - 1)), the operand ~(sb->s_blocksize - 1) is computed as a 32-bit unsigned value, then zero-extended to 64 bits when combined with the 64-bit loff_t ctx->pos, effectively clearing the high 32 bits. When directory traversal crosses the 4 GB boundary on 32-bit kernels, ctx->pos is truncated and reset into the first 4 GB, causing re-enumeration of previously returned directory entries. The fix casts the operand to loff_t before the mask operation. 64-bit kernels are unaffected. The vulnerable code path (ocfs2_dir_foreach_blk_el) is taken for all non-inline directories, affecting any directory large enough to exceed 4 GB.
Affected products
- Linux Linux kernel 5.x, 6.x, 7.x (32-bit only)
Timeline
- 2026-09-11: disclosed
- 2026-09-07: patched