CVE-2026-43075: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2writeendinline
KASAN reports a use-after-free write of 4086 bytes in ocfs2writeendinline, called from ocfs2writeendnolock during a copyfilerange splice fallback on a corrupted ocfs2 filesystem mounted on a loop device. The actual bug is an out-of-bounds write past the inode block buffer, not a true use-after-free. The write overflows into an adjacent freed page, which KASAN reports as UAF.
The root cause is that ocfs2trytowriteinlinedata trusts the on-disk idcount field to determine whether a write fits in inline data. On a corrupted filesystem, idcount can exceed the physical maximum inline data capacity, causing writes to overflow the inode block buffer.
Call trace (crash path):
vfscopyfilerange (fs/readwrite.c:1634) dosplicedirect splicedirecttoactor iterfilesplicewrite ocfs2filewriteiter genericperformwrite ocfs2writeend ocfs2writeendnolock (fs/ocfs2/aops.c:1949) ocfs2writeendinline (fs/ocfs2/aops.c:1915) memcpyfromfolio <-- KASAN: write OOB
So add idcount upper bound check in ocfs2validateinodeblock() to alongside the existing isize check to fix it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update OCFS2 to add an id_count upper bound check in ocfs2_validate_inode_block() alongside the existing i_size check, because ocfs2_try_to_write_inline_data currently trusts on-disk id_count and can overflow the inode block buffer, leading to an out-of-bounds write in ocfs2_write_end_inline (fs/ocfs2/aops.c:1915).
OCFS2 (ocfs2_validate_inode_block / ocfs2_try_to_write_inline_data / ocfs2_write_end_inline) id_count upper bound check = add validation to ensure id_count does not exceed the physical maximum inline data capacity (alongside existing i_size check)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-43075?
CVE-2026-43075 has a severity level of 7.8, classified as high.
How do I fix CVE-2026-43075?
To fix CVE-2026-43075, apply the available patch provided in the Linux kernel updates.
What does CVE-2026-43075 exploit?
CVE-2026-43075 exploits an out-of-bounds write vulnerability in the ocfs2_write_end_inline function.
Which systems are affected by CVE-2026-43075?
CVE-2026-43075 affects systems running vulnerable versions of the Linux kernel with ocfs2 support.
What is the impact of CVE-2026-43075?
The impact of CVE-2026-43075 includes potential data corruption and security risks due to a use-after-free condition.