CVE-2026-90205: ocfs2: validate orphan slot during inode read
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: validate orphan slot during inode read
Patch series "ocfs2: validate active orphan slots during inode read".
OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index osborphanwipes or the slot-local system-inode cache outside their allocations before the corruption is reported.
Patch 1 validates the ordinary orphan slot used by inode wipe processing. Patch 2 validates the append-DIO orphan slot used by DIO completion and orphan recovery. Both checks reject corrupt metadata at the existing inode validation boundary.
This patch (of 2):
[BUG] A corrupted dinode with OCFS2ORPHANEDFL can carry an iorphanedslot outside the mounted filesystem slot range. ocfs2wipeinode() uses it to index osborphanwipes before looking up the orphan directory, causing an out-of-bounds memory access.
BUG: KASAN: slab-use-after-free in ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2wipeinode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2deleteinode fs/ocfs2/inode.c:1155 [inline] ocfs2evictinode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iputfinal fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2recoverorphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2completerecovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ...
[CAUSE] ocfs2validateinodeblock() validates isuballocslot but leaves the active ordinary orphan slot unchecked. Downstream consumers assume that the value is smaller than osb->maxslots.
[FIX] Reject an active iorphanedslot outside the slot range during dinode validation, before the inode reaches orphan wipe processing.
Affected Software
Event History
Frequently Asked Questions
Under what condition can the out-of-bounds access occur?
The affected path requires a corrupted OCFS2 dinode marked with OCFS2_ORPHANED_FL whose i_orphaned_slot value is outside the mounted filesystem's slot range. During inode wipe processing, that value can be used to index osb_orphan_wipes before the orphan directory is looked up or the corruption is reported.
What does the fix do to prevent the affected access?
The fix validates the ordinary orphan slot at the existing inode validation boundary. Corrupt metadata is rejected before the slot can be used to index the orphan-wipe array or slot-local system-inode cache.