CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode()
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: add journal NULL check in ocfs2checkpointinode()
During unmount, ocfs2journalshutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2evictinode() -> ocfs2clearinode() -> ocfs2checkpointinode() -> ocfs2cifullycheckpointed() dereferences osb->journal, causing a NULL pointer dereference.
Fix this by adding a NULL check for osb->journal in ocfs2checkpointinode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix the NULL pointer dereference by updating ocfs2_checkpoint_inode() to add a NULL check for osb->journal (since ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL during unmount).
Linux kernel (OCFS2) ocfs2_checkpoint_inode(): add NULL check for osb->journal = if osb->journal is NULL, return without dereference/checkpoint work
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72161?
CVE-2026-72161 has a risk rating of 18, indicating a significant vulnerability.
What type of vulnerability is CVE-2026-72161?
CVE-2026-72161 is classified as a Null Pointer Dereference vulnerability.
How do I fix CVE-2026-72161?
To fix CVE-2026-72161, update the Linux kernel to a version that includes the patch addressing the journal NULL check.
What components are affected by CVE-2026-72161?
CVE-2026-72161 affects the OCFS2 file system in the Linux kernel.
When was CVE-2026-72161 published?
CVE-2026-72161 was published on August 15, 2026.