CVE-2026-43075

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix out-of-bounds write in ocfs2_write_end_inline

KASAN reports a use-after-free write of 4086 bytes in

ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a

copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on

a loop device. The actual bug is an out-of-bounds write past the inode

block buffer, not a true use-after-free. The write overflows into an

adjacent freed page, which KASAN reports as UAF.

The root cause is that ocfs2_try_to_write_inline_data trusts the on-disk

id_count field to determine whether a write fits in inline data. On a

corrupted filesystem, id_count can exceed the physical maximum inline data

capacity, causing writes to overflow the inode block buffer.

Call trace (crash path):

vfs_copy_file_range (fs/read_write.c:1634)

do_splice_direct

splice_direct_to_actor

iter_file_splice_write

ocfs2_file_write_iter

g

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References