The Linux kernel’s OCFS2 filesystem previously lacked a check that rejects non‑inline dinodes that declare a non‑zero size while having zero allocated clusters. A malformed dinode satisfying this invalid state could cause the filesystem to read or write beyond allocated storage, repeat fails while traversing directories, and potentially corrupt file metadata or silently drop access to data. The effect is a loss of data integrity and, in worst‑case scenarios, a denial of service for applications relying on the affected filesystem. The weakness, a failure to enforce correct size/extent limits, is reflected by CWE‑682 and can manifest as an out‑of‑bounds read or write (CWE‑125).

The issue manifests in any Linux kernel that contains the OCFS2 driver before the internal check was added. Systems using the default OCFS2 volume, especially those mounted without the OCFS2_FEATURE_INCOMPAT_SPARSE_ALLOC flag, are susceptible. All releases prior to the kernel update that introduces the reject check are affected; the exact minor revisions are not listed in the advisory.

The advisory does not provide a CVSS score or EPSS probability, and the vulnerability is not listed in the CISA KEV catalog, indicating no known active exploitation. Nevertheless, an attacker with local or root access and the ability to manipulate OCFS2 storage could craft a malformed dinode to trigger the defective behavior, leading to a denial of service or corruption of filesystem metadata. The exploit is local to the node and requires the ability to modify on‑disk structures, so the risk remains moderate to high for environments that expose such capabilities.