When an ocfs2 inode is read, the Linux kernel does not check whether the declared i_size fits within the actual inline data capacity. A corrupted filesystem can record an i_size that greatly exceeds the inline buffer's length, causing the directory iterator to process data beyond the buffer boundary. This out‑of‑bounds access triggers a use‑after‑free when the code later dereferences freed memory during directory entry processing. The result can corrupt kernel state or provide a path to execute arbitrary code with kernel privileges, a classic use‑after‑free and buffer overread flaw.

The flaw resides in the Linux kernel’s ocfs2 filesystem driver. All kernel releases prior to the commit that adds the i_size validation check are vulnerable, regardless of distribution. The associated CPE string is cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*. Users who mount a filesystem on a kernel containing ocfs2 and encounter corrupted inodes may be affected.

The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, but the exploit requires a corrupted inode that can be introduced by a local attacker or through an attacker who can control the filesystem contents. Triggering the use‑after‑free can lead to kernel privilege escalation. The attack surface is limited to systems that mount or access ocfs2 with potential corruption; it is unlikely to be remotely exploitable over the network unless the device is exposed to an attacker who can manipulate the file system.