CVE-2026-89492 - Vulnerability Details

- ocfs2: validate directory-index entry counts when reading metadata

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate directory-index entry counts when reading metadata

ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
signature of an indexed-directory block before it reaches higher-level
callers, but neither validator bounds the ocfs2_dx_entry_list counts
against the capacity of the block that holds them.

ocfs2_dx_dir_search() then walks

for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++)
dx_entry = &entry_list->de_entries[i];

over de_num_used entries with no bounds check. entry_list is either
dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root,
dx_root->dr_entries. A crafted on-disk image can set de_num_used (and
de_count, which is the __counted_by_le() bound of de_entries) to 0xffff
and make the walk read far past the end of the 4KB metadata block, giving
a slab out-of-bounds read reachable from any path lookup, stat() or open()
on an indexed directory once the image is mounted.

Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during
block read") already bounds dr_list for the non-inline dx_root, but left
the inline dr_entries path and the dx_leaf dl_list unchecked. Add the
same read-time validation for both entry lists: de_count must equal the
capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and
de_num_used must not exceed de_count, rejecting corrupted metadata with
-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry
array.

de_count is always written as exactly the block capacity when a leaf or
inline root is formatted, so the equality check does not reject any valid
image.

Found by 0sec automated security-research tooling (https://0sec.ai).

Published: 2026-09-11

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s ocfs2 file‑system component performs validation of indexed‑directory blocks but the loop that walks the entry list uses counters that are not bounded. A crafted on‑disk image can set the de_num_used field to the maximum 16‑bit value, causing the kernel to read entries far beyond the allocated 4 KB block during a directory search. This out‑of‑bounds read can be triggered by any filesystem lookup such as stat, open, or path resolution on a corrupted directory, leaking kernel memory to any process with access to the file system. The flaw is a classic read overflow (CWE‑125).

Affected Systems

All Linux kernel releases released before the commit that added bounds checking (775c17386a6f) are affected. Any system that mounts an OCFS2 file system containing a corrupted indexed directory is at risk. The vulnerability applies to the generic Linux kernel (vendor Linux) and its supported derivatives that contain the ocfs2 module.

Risk and Exploitability

With a CVSS score of 9.8 the vulnerability is rated critical, yet the EPSS score of <1% indicates that exploitation is unlikely at present. The flaw is local: an attacker must supply a crafted OCFS2 file‑system image to the kernel; no network‑based attack vector exists. Exploitation yields an out‑of‑bounds read of kernel memory, providing information disclosure but not code execution or persistence. The advisory is not listed in the CISA KEV catalog, and no public exploits are known.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`9b7895efac906d66d19856194e1ba61f37e231a4`	affected	< 5e661f55ca8568471fce558effe81cca112f5cb2
`9b7895efac906d66d19856194e1ba61f37e231a4`	affected	< fcfcba8fe17dbf2c8805690b8cc25e32d81249a4
`9b7895efac906d66d19856194e1ba61f37e231a4`	affected	< b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed
`9b7895efac906d66d19856194e1ba61f37e231a4`	affected	< bc70726ddad53c7e9a9a85915bf2415b0d4f42f9

Linux

affected

Version	Status	Constraints
`2.6.30`	affected	—
`0`	unaffected	< 2.6.30
`6.12.111`	unaffected	≤ 6.12.*
`6.18.51`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[9b7895efac906d66d19856194e1ba61f37e231a4,fcfcba8fe17dbf2c8805690b8cc25e32d81249a4)`	affected	code_commit	—
`[9b7895efac906d66d19856194e1ba61f37e231a4,b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed)`	affected	code_commit	—
`[9b7895efac906d66d19856194e1ba61f37e231a4,bc70726ddad53c7e9a9a85915bf2415b0d4f42f9)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.30`	affected	semver	—
`[0,2.6.30)`	unaffected	semver	—
`[6.18.51,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Install a Linux kernel that incorporates the ocfs2 bounds‑validation commit (775c17386a6f) or a later version
If an update cannot be applied immediately, prevent mounting OCFS2 volumes that use indexed directories until the kernel is updated, or validate the volume for corruption before mounting
Consider migrating data on critical OCFS2 devices to a different filesystem type such as ext4 or XFS to eliminate the attack surface

Generated by OpenCVE AI on September 15, 2026 at 22:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00671.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/5e661f55ca8568471fce558effe81cca112f5cb2
https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed
https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9
https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4
https://nvd.nist.gov/vuln/detail/CVE-2026-89492
https://www.cve.org/CVERecord?id=CVE-2026-89492

History

Mon, 21 Sep 2026 13:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/5e661f55ca8568471fce558effe81cca112f5cb2

Sun, 13 Sep 2026 06:45:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89492 https://www.cve.org/CVERecord?id=CVE-2026-89492
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.1, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai).
Title		ocfs2: validate directory-index entry counts when reading metadata
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9 https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:44.137Z

Updated: 2026-09-21T13:14:21.626Z

Reserved: 2026-09-11T19:38:34.713Z

Link: CVE-2026-89492

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:31.090

Modified: 2026-09-21T14:17:22.547

Link: CVE-2026-89492

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:44Z

Links: CVE-2026-89492 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:45:07Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object