CVE-2026-72159

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject non-inline dinodes with i_size and zero i_clusters

On a volume mounted without OCFS2_FEATURE_INCOMPAT_SPARSE_ALLOC, a

non-inline regular file with non-zero i_size and zero i_clusters is

structurally malformed: the extent map declares no allocated clusters yet

the size header claims content exists. Keep rejecting that shape, but

express it through a shared predicate so the same invariant is available

to normal inode reads and online filecheck.

The same zero-cluster shape is also malformed for non-inline directories.

ocfs2 directory growth allocates backing storage before advancing i_size,

and ocfs2_dir_foreach_blk_el() later walks until ctx->pos reaches

i_size_read(inode). A forged directory dinode with a huge i_size and no

clusters would repeatedly fail on holes while advancing through the

claimed size.

Sparse regular files remain exempt: on sparse-alloc volumes, truncate can

legitimately grow i_si

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References