CVE-2026-89490

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix readdir position truncation on 32-bit kernels

In ocfs2_dir_foreach_blk_el(), the directory cookie position is

rebuilt with

ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) | offset;

`ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is

unsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask

~(sb->s_blocksize - 1)

is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB

block size). In the AND expression with the 64-bit `ctx->pos`, that

unsigned operand is zero-extended to 64 bits per the usual arithmetic

conversions, yielding 0x00000000fffff000. The high 32 bits of

`ctx->pos` are silently cleared, even though directory size is

allowed to exceed 4 GiB.

When readdir() crosses the 4 GiB boundary on a 32-bit kernel the

position is reset back into the first 4 GiB block, making the

re-validation path re-enumerate already-returned dirents indefinitely.

This is ocfs2_di

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References