CVE-2026-72162

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

State: Published
Severity: 7.8 High
Published: Aug 15, 2026
Updated: Oct 30, 2026
Reserved: Aug 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file.

[CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.

[FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before c88226315aec298894ec57e532f5e95f3b09e874Affected dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before c286319746cef02bcce7384fda3a3f08989070d2Affected dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 720fb324cf0f5116318cae7f75cb393d118ffb67Affected dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1Affected dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85Affected dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 452a8467be8143747292218212671deeb186d2aeAffected
LinuxLinux	2.6.22Affected before 2.6.22Not affected 6.1.191 through 6.1.Not affected 6.6.160 through 6.6.Not affected 6.12.114 through 6.12.Not affected 6.18.40 through 6.18.Not affected 7.1.5 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before c88226315aec298894ec57e532f5e95f3b09e874Affected
dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before c286319746cef02bcce7384fda3a3f08989070d2Affected
dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 720fb324cf0f5116318cae7f75cb393d118ffb67Affected
dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1Affected
dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85Affected
dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 to before 452a8467be8143747292218212671deeb186d2aeAffected

LinuxLinux

2.6.22Affected
before 2.6.22Not affected
6.1.191 through 6.1.*Not affected
6.6.160 through 6.6.*Not affected
6.12.114 through 6.12.*Not affected
6.18.40 through 6.18.*Not affected
7.1.5 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.