CVE-2026-72162: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec
[BUG] On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file.
[CAUSE] ocfs2sumrightmostrec() computes i = le16tocpu(el->lnextfreerec) - 1 and accesses el->lrecs[i] without validating i. When lnextfreerec is 0, i becomes -1; when lnextfreerec exceeds lcount, i falls past the end of the array. Either case violates the countedbyle(lcount) annotation on lrecs[] and triggers UBSAN.
[FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2validateinodeblock(): lcount must be non-zero and no larger than the inode block can hold, and lnextfreerec must not exceed lcount. A corrupt list is rejected at read time, before the b-tree code can index lrecs[] out of bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Fix ocfs2 UBSAN array-index-out-of-bounds by validating the inode's embedded extent list when the inode is read, ensuring l_count is non-zero, l_count is not larger than the inode block can hold, and l_next_free_rec does not exceed past the end of the array before indexing el->l_recs[i].
Linux kernel (ocfs2) Validate inode embedded extent list at read time = enabled
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72162?
The severity of CVE-2026-72162 is rated at risk level 27.
How do I fix CVE-2026-72162?
To fix CVE-2026-72162, update the Linux kernel to the latest version that includes the patch.
What is the impact of CVE-2026-72162?
CVE-2026-72162 can cause on-disk corruption leading to a UBSAN panic during file write operations.
Which software is affected by CVE-2026-72162?
CVE-2026-72162 affects the Linux kernel, specifically the OCFS2 filesystem.
When was CVE-2026-72162 published?
CVE-2026-72162 was published on August 15, 2026.