CVE-2026-93258
Received Received - Intake

OCFS2 Directory Inode Corruption via make_bad_inode

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: do not use make_bad_inode() in ocfs2_read_inode_block_full() This reverts commit 58b6fcd2ab34 ("ocfs2: mark inode bad upon validation failure during read"). Since 'make_bad_inode()' resets inode type to S_IFREG, doing this for directory inode during active VFS lookup is likely to confuse the latter, including VFS_BUG_ON_INODE() triggered in this case.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-93258
EUVD
EUVD-2026-86130

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
linux kernel *
oracle ocfs2 *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the OCFS2 file system where using make_bad_inode() during inode block reading could corrupt directory inode types. This may trigger VFS_BUG_ON_INODE() errors, disrupting file system operations and causing system instability.

Detection Guidance

This vulnerability is specific to the Linux kernel's OCFS2 filesystem and involves inode handling during read operations. Detection would require checking kernel logs for filesystem errors or crashes related to OCFS2, particularly during directory inode reads. Commands like dmesg, journalctl -k, or checking /var/log/messages for OCFS2-related errors may help identify issues.

Impact Analysis

If exploited, this vulnerability could lead to file system corruption, data loss, or system crashes. Users relying on OCFS2 for storage may experience unexpected errors or failures during file operations, potentially disrupting services or applications.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is specific to the Linux kernel's ocfs2 filesystem and involves inode handling during read operations. There is no evidence in the provided context that this issue impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this ocfs2 vulnerability. Check your distribution's security advisories for kernel updates addressing this specific issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-93258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart