CVE-2026-72162

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[BUG]

On-disk corruption setting l_next_free_rec to 0 in an inode's embedded

extent list triggers a UBSAN panic on the next write to that file.

[CAUSE]

ocfs2_sum_rightmost_rec() computes

i = le16_to_cpu(el->l_next_free_rec) - 1

and accesses el->l_recs[i] without validating i. When l_next_free_rec

is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls

past the end of the array. Either case violates the

__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.

[FIX]

Validate the inode's embedded extent list when the inode is read, in

ocfs2_validate_inode_block(): l_count must be non-zero and no larger

than the inode block can hold, and l_next_free_rec must not exceed

l_count. A corrupt list is rejected at read time, before the b-tree

code can index l_recs[] out of bounds.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References