Executive brief
A flaw in the Linux kernel's OCFS2 filesystem allows a local attacker who can mount a crafted or corrupted filesystem to trigger an out-of-bounds memory read and write. This could lead to kernel crashes (denial of service) or potentially allow code execution. The vulnerability requires administrative privileges and affects systems using OCFS2, a shared cluster filesystem.
Technical details
The vulnerability exists in ocfs2_find_refcount_rec_in_rl() and ocfs2_validate_refcount_block() functions. The refcount block validator fails to validate that rl_used and rl_count fields are within the on-disk capacity of the refcount record array (247 records for a 4K block). A crafted refcount block with rl_used set to 0xffff causes the loop to walk far past the end of the block, dereferencing array elements at indices up to 65534. This out-of-bounds index is then passed to ocfs2_insert_refcount_rec(), which performs a memmove() of up to ~1 MiB from an invalid offset, causing heap corruption. The attack is triggered via a reflink (FICLONE) operation on a crafted or corrupted OCFS2 image. The fix adds validation checks to reject refcount blocks where rl_count does not match the expected capacity or where rl_used exceeds rl_count, mirroring existing checks in ocfs2_validate_extent_block().
Affected products
- Linux Linux kernel prior to patch (kernel version not specified in advisory)
Timeline
- 2026-09-11: disclosed