CVE-2026-89492

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate directory-index entry counts when reading metadata

ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and

signature of an indexed-directory block before it reaches higher-level

callers, but neither validator bounds the ocfs2_dx_entry_list counts

against the capacity of the block that holds them.

ocfs2_dx_dir_search() then walks

for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++)

dx_entry = &entry_list->de_entries[i];

over de_num_used entries with no bounds check. entry_list is either

dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root,

dx_root->dr_entries. A crafted on-disk image can set de_num_used (and

de_count, which is the __counted_by_le() bound of de_entries) to 0xffff

and make the walk read far past the end of the 4KB metadata block, giving

a slab out-of-bounds read reachable from any path lookup, stat() or open()

on an indexed directory once the im

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References