CVE-2026-72159: ocfs2: reject non-inline dinodes with i_size and zero i_clusters

Published Aug 15, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject non-inline dinodes with isize and zero iclusters

On a volume mounted without OCFS2FEATUREINCOMPATSPARSEALLOC, a non-inline regular file with non-zero isize and zero iclusters is structurally malformed: the extent map declares no allocated clusters yet the size header claims content exists. Keep rejecting that shape, but express it through a shared predicate so the same invariant is available to normal inode reads and online filecheck.

The same zero-cluster shape is also malformed for non-inline directories. ocfs2 directory growth allocates backing storage before advancing isize, and ocfs2dirforeachblkel() later walks until ctx->pos reaches isizeread(inode). A forged directory dinode with a huge isize and no clusters would repeatedly fail on holes while advancing through the claimed size.

Sparse regular files remain exempt: on sparse-alloc volumes, truncate can legitimately grow isize without allocating clusters. System inodes and inline-data dinodes also retain their separate storage rules.

Mirror the check in ocfs2filecheckvalidateinodeblock() as well. filecheck reports through its own error namespace, so malformed size/cluster state is logged as a filecheck invalid-inode result rather than via ocfs2error(), but it must not proceed into ocfs2populateinode().

Affected Software

1 affected component
Linux Linux kernel

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Compensating control

    If the OCFS2 volume is mounted without OCFS2_FEATURE_INCOMPAT_SPARSE_ALLOC, ensure that truncated/sparse regular files are handled appropriately: sparse regular files remain exempt on such mounts, while on sparse-alloc volumes truncate behavior must not allow malformed directory/dinode shapes to advance i_size/position tracking.

Event History

Aug 15, 2026
CVE Published
via MITRE·05:53 AM
Data Sourced
via MITRE·05:53 AM
Description
Data Sourced
via NVD·06:21 AM
Description
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-72159?

The CVE-2026-72159 vulnerability has a risk rating of 34.

2

How do I fix CVE-2026-72159?

To fix CVE-2026-72159, ensure that your system is updated to a Linux kernel version that includes the resolution for this vulnerability.

3

What systems are affected by CVE-2026-72159?

CVE-2026-72159 affects Linux systems using the OCFS2 filesystem that have non-inline regular files with non-zero i_size and zero i_clusters.

4

What is the impact of CVE-2026-72159 on affected systems?

The impact of CVE-2026-72159 includes the potential for structural malformation of files, which may lead to data corruption.

5

When was CVE-2026-72159 published?

CVE-2026-72159 was published on August 15, 2026.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203