CVE-2026-72164

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: avoid moving extents to occupied clusters

For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical

me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and

expects ocfs2_probe_alloc_group() to replace it with a free run in the

target block group.

The probe currently leaves *phys_cpos unchanged if the scan reaches the

end of the group without finding a free run. An occupied goal at the last

bit can therefore survive the probe and be passed to

__ocfs2_move_extent(), which copies file data into a cluster still owned

by another inode before the bitmap is updated.

When the probe does find a free run, it also subtracts move_len from the

ending bit. The start of an N-bit run ending at i is i - N + 1, so the

current calculation can report the bit immediately before the free run.

Clear *phys_cpos before scanning and use the correct free-run start.

Callers already treat a zero re

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References