CVE-2026-72160

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject dinodes with non-canonical i_mode type

Patch series "ocfs2: harden inode validators against forged metadata", v2.

This series adds three structural checks to OCFS2 dinode validation so

malformed on-disk fields are rejected before ocfs2_populate_inode() copies

them into the in-core inode.

The checks cover:

- i_mode values whose type bits do not name a canonical POSIX file

type;

- non-device dinodes whose id1.dev1.i_rdev field is non-zero; and

- non-inline dinodes that claim non-zero i_size while i_clusters is

zero, covering directories unconditionally and regular files on

non-sparse volumes.

The normal read path reports these through ocfs2_error(), matching the

existing suballoc-slot, inline-data, chain-list, and refcount checks. The

online filecheck path uses the same structural predicates but keeps its

own reporting contract, returning OCFS2_FILECHECK_ERR_INVALIDINO instead

of ca

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References