CVE-2026-72162
Received Received - Intake

Array Index Out of Bounds in OCFS2 Kernel Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec [BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72162
EUVD
EUVD-2026-58920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oracle ocfs2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the OCFS2 file system. It involves an array-index-out-of-bounds issue in the function ocfs2_sum_rightmost_rec. When an inode's embedded extent list is corrupted on disk, setting l_next_free_rec to 0 triggers a UBSAN panic during the next file write. The root cause is a lack of validation for the index computed from l_next_free_rec before accessing the array l_recs.

Detection Guidance

This vulnerability is specific to the Linux kernel's OCFS2 filesystem and requires on-disk corruption detection. Check kernel logs for UBSAN panics related to ocfs2_sum_rightmost_rec. Use 'dmesg | grep -i ocfs2' to search for filesystem errors. Validate OCFS2 inodes with 'fsck.ocfs2 -n /dev/sdX' for potential corruption.

Impact Analysis

This vulnerability can cause system crashes due to UBSAN panics when writing to corrupted files. It may lead to data corruption or loss if the file system becomes unstable. Systems using OCFS2 for storage could experience unexpected downtime or require recovery procedures.

Mitigation Strategies

Upgrade to a kernel version containing the fix. Avoid writing to potentially corrupted OCFS2 filesystems. If corruption is suspected, run 'fsck.ocfs2 -y /dev/sdX' to repair. Monitor filesystem health and kernel logs for UBSAN errors.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72162. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart