CVE-2026-89492

Received Received - Intake

Buffer Overflow in OCFS2 File System

Publication date: 2026-09-11

Last updated on: 2026-09-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-11

Last Modified

2026-09-11

Generated

2026-09-12

AI Q&A

2026-09-12

EPSS Evaluated

N/A

NVD

CVE-2026-89492

EUVD

EUVD-2026-76398

Affected Vendors & Products

Vendor	Product	Version / Range
oracle	ocfs2	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's OCFS2 file system. It involves a lack of bounds checking when reading directory-index entries in metadata blocks. Attackers can craft a malicious disk image that sets entry counts to extreme values, causing the system to read far beyond the allocated memory block during file operations like lookup, stat, or open. This leads to a slab out-of-bounds read, potentially allowing unauthorized memory access.

Detection Guidance

This vulnerability affects the Linux kernel's OCFS2 filesystem. Detection requires checking for OCFS2 filesystem usage and potential corruption. Inspect mounted OCFS2 volumes with 'mount | grep ocfs2' and examine kernel logs for filesystem errors. No direct network detection commands are applicable as this is a local filesystem issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read sensitive memory data or cause system instability. Since it is triggered by mounting a crafted disk image, any user with access to mount filesystems could potentially exploit it. The impact includes unauthorized information disclosure and potential denial-of-service conditions.

Mitigation Strategies

Apply the Linux kernel patch that adds validation for dx_root and dx_leaf entry counts. Update to a kernel version containing commit 775c17386a6f or later. Avoid mounting untrusted OCFS2 images until patched. Monitor filesystem integrity with fsck.ocfs2.

Hi! I’m here to help you understand CVE-2026-89492. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70