UBUNTU-CVE-2026-90205: Use After Free

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index osborphanwipes or the slot-local system-inode cache outside their allocations before the corruption is reported. Patch 1 validates the ordinary orphan slot used by inode wipe processing. Patch 2 validates the append-DIO orphan slot used by DIO completion and orphan recovery. Both checks reject corrupt metadata at the existing inode validation boundary. This patch (of 2): [BUG] A corrupted dinode with OCFS2ORPHANEDFL can carry an iorphanedslot outside the mounted filesystem slot range. ocfs2wipeinode() uses it to index osborphanwipes before looking up the orphan directory, causing an out-of-bounds memory access. BUG: KASAN: slab-use-after-free in ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2getsystemfileinode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2wipeinode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2deleteinode fs/ocfs2/inode.c:1155 [inline] ocfs2evictinode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iputfinal fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2recoverorphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2completerecovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ... [CAUSE] ocfs2validateinodeblock() validates isuballocslot but leaves the active ordinary orphan slot unchecked. Downstream consumers assume that the value is smaller than osb->maxslots. [FIX] Reject an active iorphanedslot outside the slot range during dinode validation, before the inode reaches orphan wipe processing.