CVE-2026-90204: ocfs2: validate DIO orphan slot during inode read
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate DIO orphan slot during inode read
[BUG] A corrupted append-DIO dinode (high byte at offset 0xa1 corrupted from 0 to 1) can carry an idioorphanedslot outside the mounted filesystem slot range and trigger a use-after-free error:
BUG: KASAN: slab-use-after-free in ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2wipeinode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2deleteinode fs/ocfs2/inode.c:1155 [inline] ocfs2evictinode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iputfinal fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2recoverorphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2completerecovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ...
[CAUSE] ocfs2delinodefromorphan() uses idioorphanedslot to index the slot-local system inode cache. The dinode validator does not check this active slot, so an out-of-range value produces an invalid cache entry pointer that is dereferenced as an inode pointer.
[FIX] Reject an active idioorphanedslot outside the slot range during dinode validation, before DIO orphan recovery can consume it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.52 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 7.2.6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Linux systems mounting an OCFS2 filesystem are exposed when they process a corrupted append-DIO dinode whose orphan slot value falls outside the mounted filesystem's slot range.
What condition is needed to trigger the use-after-free?
The affected dinode must contain an out-of-range i_dio_orphaned_slot value. During orphan recovery or inode eviction, OCFS2 uses that value to index a slot-local system inode cache, which can yield an invalid cache entry pointer.
How can an administrator recognize a possible occurrence?
A KASAN report may identify a slab use-after-free involving ocfs2_get_system_file_inode, called through ocfs2_wipe_inode, ocfs2_evict_inode, and orphan recovery functions such as ocfs2_recover_orphans or ocfs2_complete_recovery.