Executive brief
OCFS2 is a clustered filesystem used in some enterprise storage systems. A corrupted filesystem metadata file (dinode) could contain an invalid orphan slot index that causes the kernel to access memory outside allocated bounds when processing orphaned inodes, potentially leading to a system crash or memory corruption.
Technical details
The vulnerability is an out-of-bounds memory access (CWE-129) in the ocfs2 filesystem driver's inode deletion path. A malicious or corrupted dinode with the OCFS2_ORPHANED_FL flag set can specify an i_orphaned_slot value outside the valid range (0 to osb->max_slots). When ocfs2_wipe_inode() attempts to index the osb_orphan_wipes array or the slot-local system-inode cache using this out-of-bounds slot value, it causes a use-after-free or slab access violation. The vulnerability requires local filesystem access to craft a malicious dinode; the fix validates the i_orphaned_slot during dinode validation before orphan processing begins.
Affected products
- Linux Linux kernel versions with ocfs2 filesystem support prior to the fix
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched