CVE-2026-43076

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate inline data i_size during inode read

When reading an inode from disk, ocfs2_validate_inode_block() performs

various sanity checks but does not validate the size of inline data. If

the filesystem is corrupted, an inode's i_size can exceed the actual

inline data capacity (id_count).

This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data

buffer, triggering a use-after-free when accessing directory entries from

freed memory.

In the syzbot report:

- i_size was 1099511627576 bytes (~1TB)

- Actual inline data capacity (id_count) is typically <256 bytes

- A garbage rec_len (54648) caused ctx->pos to jump out of bounds

- This triggered a UAF in ocfs2_check_dir_entry()

Fix by adding a validation check in ocfs2_validate_inode_block() to ensure

inodes with inline data have i_size <= id_count. This catches the

corruption early during inode read and prevents all downstream code from

o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References