Description
In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate directory-index entry counts when reading metadata

ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
signature of an indexed-directory block before it reaches higher-level
callers, but neither validator bounds the ocfs2_dx_entry_list counts
against the capacity of the block that holds them.

ocfs2_dx_dir_search() then walks

for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++)
dx_entry = &entry_list->de_entries[i];

over de_num_used entries with no bounds check. entry_list is either
dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root,
dx_root->dr_entries. A crafted on-disk image can set de_num_used (and
de_count, which is the __counted_by_le() bound of de_entries) to 0xffff
and make the walk read far past the end of the 4KB metadata block, giving
a slab out-of-bounds read reachable from any path lookup, stat() or open()
on an indexed directory once the image is mounted.

Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during
block read") already bounds dr_list for the non-inline dx_root, but left
the inline dr_entries path and the dx_leaf dl_list unchecked. Add the
same read-time validation for both entry lists: de_count must equal the
capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and
de_num_used must not exceed de_count, rejecting corrupted metadata with
-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry
array.

de_count is always written as exactly the block capacity when a leaf or
inline root is formatted, so the equality check does not reject any valid
image.

Found by 0sec automated security-research tooling (https://0sec.ai).
Published: 2026-09-11
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: Out-of-bounds read of kernel memory via malformed ocfs2 directory metadata
Action: Update kernel
AI Analysis

Impact

The Linux kernel’s ocfs2 file‑system implementation performs directory‑index searches without fully validating the entry list counts. A crafted on‑disk image can set the de_num_used field to 0xffff, causing the 4 KB block during ocfs2_dx_dir_search. This out‑of‑bounds read can leak kernel memory to any local process performing a stat(), open(), or other open‑path operation on the corrupted directory, resulting in information disclosure. The weakness is a classic out‑of‑bounds read (CWE‑125).

Affected Systems

All Linux kernel releases that ship the original ocfs2 handler and still lack the bounds‑validation commit (775c17386a6f) are vulnerable. Any kernel version prior to that commit, regardless of minor version, is at risk when it mounts or accesses an OCFS2 file system containing corrupted indexed directories.

Risk and Exploitability

The CVSS score of 4.1 indicates moderate severity, while the EPSS score of 0.00198 (about < 1%) indicates a very low but non‑zero exploitation probability, and the issue is not listed in theoitation requires local access to the device containing the corrupted OCFS2 file system or to a privileged process that can mount it. The; it does not grant arbitrary code execution. The risk is therefore limited to read‑only memory leaks, but it remains a significant concern for systems handling sensitive data on OCFS2 volumes.

Generated by OpenCVE AI on September 13, 2026 at 03:00 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply a Linux kernel update that includes the ocfs2 directory‑index bounds validation commit (775c17386a6f).
  • If an immediate kernel upgrade is infeasible, avoid mounting or accessing OCFS2 filesystems containing indexed directories until the patch is applied; consider using a different filesystem for new volumes.
  • Review all mounted ocfs2 filesystems and verify that none contain corrupted indexed directories in devices that might be vulnerable until the kernel update is applied.

Generated by OpenCVE AI on September 13, 2026 at 03:00 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 13 Sep 2026 06:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Sat, 12 Sep 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Fri, 11 Sep 2026 23:45:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai).
Title ocfs2: validate directory-index entry counts when reading metadata
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-09-13T06:30:00.175Z

Reserved: 2026-09-11T19:38:34.713Z

Link: CVE-2026-89492

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-11T20:19:31.090

Modified: 2026-09-13T07:17:12.417

Link: CVE-2026-89492

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:44Z

Links: CVE-2026-89492 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-09-13T03:15:13Z

Weaknesses