CVE-2026-72162
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
In the Linux kernel, the OCFS2 filesystem has a bug in ocfs2_sum_rightmost_rec that can lead to an array-index-out-of-bounds (UBSAN) when on-disk data is corrupted. The function does not validate l_next_free_rec before using it to index the l_recs array.
Risk Assessment
This can lead to a UBSAN panic and system crash, potentially resulting in service unavailability and potential data loss.
Recommendation
It is recommended to apply the patch that adds validation of the extent list in ocfs2_validate_inode_block, and update the kernel to a version with the fix.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec [BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.