CVE-2026-72163
Received Received - Intake

NULL Pointer Dereference in OCFS2 Kernel Filesystem

Publication date: 2026-08-15

Last updated on: 2026-08-15

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits [BUG] A direct write over unwritten extents can panic the kernel in ocfs2_assure_trans_credits() when the journal aborts during DIO completion. The crash is a general protection fault from a NULL pointer dereference. [CAUSE] ocfs2_dio_end_io_write() loops over a direct write's unwritten extents, marking each written under a single journal handle. If the journal aborts (for example after an I/O error) while the extent tree is being updated, the handle is left aborted with its transaction pointer cleared. The extent merge treats that failure as not critical and reports success, so the loop keeps using the handle. ocfs2_assure_trans_credits() reads the handle's remaining credits without first checking whether the handle is aborted, and that read dereferences the cleared transaction pointer. [FIX] A journal abort is recorded in the handle itself, so callers are expected to test the handle rather than rely on a returned error. Make ocfs2_assure_trans_credits() do that, as the other ocfs2 journal helpers already do, and return -EROFS when the handle is aborted.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-15
Last Modified
2026-08-15
Generated
2026-08-15
AI Q&A
2026-08-15
EPSS Evaluated
N/A
NVD
CVE-2026-72163
EUVD
EUVD-2026-58921

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
oracle ocfs2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability in the OCFS2 file system. It occurs when a direct write operation over unwritten extents causes a kernel panic due to a NULL pointer dereference in the ocfs2_assure_trans_credits function. The crash happens when the journal aborts during direct I/O completion, leaving the handle in an aborted state with a cleared transaction pointer.

Detection Guidance

This vulnerability is specific to the Linux kernel's OCFS2 filesystem and requires kernel-level detection. Monitor kernel logs for general protection faults or NULL pointer dereferences related to ocfs2_assure_trans_credits. Check for crashes during direct I/O operations on OCFS2 volumes. Use commands like dmesg | grep -i "ocfs2\|general protection" or journalctl -k | grep -i "ocfs2" to inspect kernel logs for suspicious activity.

Impact Analysis

This vulnerability can cause system crashes (kernel panics) when performing direct write operations on OCFS2 file systems. The crash occurs due to a NULL pointer dereference, which may lead to data corruption or denial of service if the system becomes unresponsive.

Mitigation Strategies

Apply the latest Linux kernel patches that include the fix for this OCFS2 vulnerability. If immediate patching is not possible, avoid using direct I/O (DIO) operations on OCFS2 volumes until patched. Monitor filesystem operations closely and disable OCFS2 if crashes are detected to prevent data corruption or system instability.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72163. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart