The Linux kernel’s OCFS2 cluster file system previously allowed malformed on‑disk inode structures called dinodes to be accepted and copied into kernel memory without validation. A dinode whose i_mode bits do not match one of the seven canonical POSIX file types, a non‑device rdev field set when it should be zero, or a size mismatch could cause the kernel to invoke special‑file handlers or otherwise crash. The patch series added structural checks that reject any dinode whose type bits do not belong to a canonical POSIX file type, validates rdev fields for non‑device inodes, and enforces size consistency before populating an inode, thereby preventing a kernel panic.

Affected systems: The CNA lists only “Linux:Linux” with no version details, indicating that any Linux distribution shipping the generic kernel with the OCFS2 file system enabled is potentially vulnerable. In particular, systems running older kernel releases prior to the inclusion of the ocfs2 hardening patch series (v2) are at risk. Because the vulnerability resides in the kernel’s OCFS2 implementation, the issue persists across all kernel configurations that load the ocfs2 module, regardless of whether the file system is actively mounted.

The CVSS score of 8.8 indicates high severity due to a denial‑of‑service impact. The EPSS score is listed as < 1 %, showing a very low but non‑zero probability of exploitation. The vulnerability is not currently catalogued in CISA’s KEV catalogue, but an attacker who can write crafted metadata to an OCFS2 volume could trigger a kernel crash by causing the system to read the forged dinode. Consequently, the risk is high if the volume is writable by an attacker, moderate if write access is restricted, and negligible in a read‑only environment.