Executive brief
The Linux kernel's OCFS2 filesystem driver fails to properly validate indexed directory metadata when reading from disk, allowing attackers to craft a malicious filesystem image that triggers an out-of-bounds memory read. When a user accesses a directory on such a filesystem (via file listing, stat, or open operations), the vulnerability exposes kernel memory contents, potentially leaking sensitive data and enabling further exploitation.
Technical details
The vulnerability is a heap out-of-bounds read in OCFS2's directory-index code. The validators ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() perform ECC and signature checks on indexed-directory blocks but do not validate that entry list counts (de_num_used, de_count) remain within the 4KB block's capacity. The function ocfs2_dx_dir_search() then iterates over de_num_used entries without bounds checking. A crafted on-disk image can set these counts to 0xffff, causing the iteration to read far beyond the metadata block boundary. The fix adds read-time validation to ensure de_count equals the calculated block capacity and de_num_used does not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before the vulnerable walk occurs.
Affected products
- Linux Linux kernel all versions with OCFS2 filesystem support (patched in commit 775c17386a6f and follow-up fixes)
Timeline
- 2026-09-11: disclosed: CVE-2026-89492 published