CVE-2026-63796: ocfs2: reject oversized group bitmap descriptors
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: reject oversized group bitmap descriptors
ocfs2validategdparent() only bounds bgbits against the parent allocator's chain geometry. A malicious descriptor can still claim a bgsize/bgbits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bgbitmap.
Add a physical-cap check based on ocfs2groupbitmapsize() for the parent allocator type and reject descriptors whose bgsize or bgbits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used.
Validation reproduced this kernel report: KASAN use-after-free in findnextbit+0x7f/0xc0 Read of size 8 Call trace: dumpstacklvl+0x66/0xa0 (?:?) printreport+0xd0/0x630 (?:?) findnextbit+0x7f/0xc0 (?:?) srsoaliasreturnthunk+0x5/0xfbef5 (?:?) virtaddrvalid+0x188/0x2f0 (?:?) kasanreport+0xe4/0x120 (?:?) ocfs2findmaxcontigfreebits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2blockgroupsetbits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2clustergroupsearch+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2bgdiscontigfixresult+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2searchchain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) getpagefromfreelist+0x70e/0x2370 (?:?) lockrelease+0xc6/0x290 (?:?) dorawspinunlock+0x9a/0x100 (?:?) kasanunpoison+0x27/0x60 (?:?) bfs+0x147/0x240 (?:?) getpagefromfreelist+0x83d/0x2370 (?:?) ocfs2claimsuballocbits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) scheddomainsnumamasksclear+0x70/0xd0 (?:?) checkirqusage+0xe8/0xb70 (?:?) ocfs2claimclusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) checkpath+0x24/0x50 (?:?) rcuiswatching+0x20/0x50 (?:?) checkprevadd+0xfd/0xd00 (?:?) ocfs2addclustersinbtree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) foliobatchaddandmove+0x1f5/0x3d0 (?:?) ocfs2addinodedata+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemapaddfolio+0x105/0x1f0 (?:?) ocfs2writebeginnolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2readinodeblock+0xb5/0x110 (fs/ocfs2/suballoc.c:?) downwrite+0xf5/0x180 (?:?) ocfs2writebegin+0x180/0x240 (fs/ocfs2/suballoc.c:?) markinodedirty+0x758/0x9a0 (?:?) inodetobdi+0x41/0x90 (?:?) balancedirtypagesratelimitedflags+0xf8/0x1d0 (?:?) genericperformwrite+0x252/0x440 (?:?) mntputwriteaccessfile+0x16/0x70 (?:?) fileupdatetimeflags+0xe4/0x200 (?:?) ocfs2filewriteiter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lockacquire+0x184/0x2f0 (?:?) ksyswrite+0xd2/0x170 (?:?) apparmorfilepermission+0xf5/0x310 (?:?) readzero+0x8d/0x140 (?:?) lockisheldtype+0x8f/0x100 (?:?)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.150.1-1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch KASAN use-after-free in _find_next_bit+0x7f/0xc0 - Configuration
Update OCFS2 group bitmap descriptor validation so only descriptors that pass both: (1) the existing chain geometry check and (2) a new physical capacity check based on ocfs2_group_bitmap_size() for the parent are accepted, rejecting mismatched/oversized bg_size/bg_bits pairs ("ocfs2: reject oversized group bitmap descriptors").
ocfs2 (fs/ocfs2/suballoc.c) group bitmap descriptor validation = Add a physical-cap check using ocfs2_group_bitmap_size() for the parent; keep chain geometry check; reject descriptors whose bg_size or bg_bits exceed the bitmap bytes that physically fit in the bitmap layout and allocator metadata must agree before accepting the descriptor capacity.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63796?
CVE-2026-63796 has a severity rating of high with a score of 8.8 according to CVSS 3.1.
What is the main issue described in CVE-2026-63796?
CVE-2026-63796 involves the rejection of oversized group bitmap descriptors in the OCFS2 filesystem of the Linux kernel.
How do I fix CVE-2026-63796?
To fix CVE-2026-63796, update to the patched version of the Linux kernel that addresses this vulnerability.
What types of attacks does CVE-2026-63796 potentially enable?
CVE-2026-63796 could enable attackers to exploit oversized group bitmap descriptors leading to potential use-after-free vulnerabilities.
When was CVE-2026-63796 published?
CVE-2026-63796 was published on July 19, 2026.