UBUNTU-CVE-2026-72162: High severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2sumrightmostrec [BUG] On-disk corruption setting lnextfreerec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2sumrightmostrec() computes i = le16tocpu(el->lnextfreerec) - 1 and accesses el->lrecs[i] without validating i. When lnextfreerec is 0, i becomes -1; when lnextfreerec exceeds lcount, i falls past the end of the array. Either case violates the countedbyle(lcount) annotation on lrecs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2validateinodeblock(): lcount must be non-zero and no larger than the inode block can hold, and lnextfreerec must not exceed lcount. A corrupt list is rejected at read time, before the b-tree code can index lrecs[] out of bounds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/linux-aws-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1017.17~24.04.1 - Upgrade
Upgrade
ubuntu/linux-azure-fde-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1016.16~24.04.1 - Upgrade
Upgrade
ubuntu/linux-gcp-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1014.14~24.04.1 - Upgrade
Upgrade
ubuntu/linux-hwe-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38~24.04.4 - Upgrade
Upgrade
ubuntu/linux-nvidia-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1024.25~24.04.1 - Upgrade
Upgrade
ubuntu/linux-nvidia-tegrato a version that resolves this vulnerability.Fixed in 6.8.0-1036.39 - Upgrade
Upgrade
ubuntu/linux-oracle-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1013.13~24.04.1 - Upgrade
Upgrade
ubuntu/linux-riscv-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1~24.04.1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 7.0.0-38.38 - Upgrade
Upgrade
ubuntu/linux-awsto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-azureto a version that resolves this vulnerability.Fixed in 7.0.0-1017.17 - Upgrade
Upgrade
ubuntu/linux-azure-fdeto a version that resolves this vulnerability.Fixed in 7.0.0-1016.16 - Upgrade
Upgrade
ubuntu/linux-gcpto a version that resolves this vulnerability.Fixed in 7.0.0-1014.14 - Upgrade
Upgrade
ubuntu/linux-gketo a version that resolves this vulnerability.Fixed in 7.0.0-1008.9 - Upgrade
Upgrade
ubuntu/linux-ibmto a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-nvidia-bosto a version that resolves this vulnerability.Fixed in 7.0.0-2022.23 - Upgrade
Upgrade
ubuntu/linux-oem-7.0to a version that resolves this vulnerability.Fixed in 7.0.0-1015.15 - Upgrade
Upgrade
ubuntu/linux-oracleto a version that resolves this vulnerability.Fixed in 7.0.0-1013.13 - Upgrade
Upgrade
ubuntu/linux-realtimeto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Upgrade
Upgrade
ubuntu/linux-riscvto a version that resolves this vulnerability.Fixed in 7.0.0-38.38.1 - Compensating control
In ocfs2_validate_inode_block(), validate the inode's embedded extent list when the inode is read: require l_count to be non-zero and no larger than the inode block can hold, and require l_next_free_rec not to exceed l_count.
Event History
Frequently Asked Questions
What systems are realistically exposed to this issue?
Systems using OCFS2 filesystems are exposed if they read an inode with a corrupted embedded extent list. The affected Ubuntu kernel package families listed are linux, linux-fips, linux-aws, linux-azure, linux-aws-fips, linux-azure-fips, linux-gcp, and linux-gcp-fips.
What is required to trigger the failure?
A corrupted OCFS2 inode embedded extent list is required, specifically one with l_next_free_rec set to 0 or greater than l_count. The reported failure occurs on a subsequent write to the affected file, when the kernel indexes the malformed extent-record array.
How does the fix prevent exploitation or failure?
The fix validates the embedded extent list when the inode is read. It rejects lists whose l_count is zero or too large for the inode block, or whose l_next_free_rec exceeds l_count, before b-tree code can access the record array out of bounds.