CVE-2026-89490
UnknownSummary
In the Linux kernel, the ocfs2 function ocfs2_dir_foreach_blk_el() on 32-bit kernels incorrectly computed the directory position mask, clearing the high 32 bits of the position. When readdir() crossed the 4 GiB boundary, the position was reset, causing infinite re-enumeration of already-returned directory entries.
Risk Assessment
On 32-bit systems with OCFS2 directories larger than 4 GiB, readdir() may loop indefinitely, causing a process or system hang (denial of service).
Recommendation
Update the Linux kernel to a version containing the fix that casts sb->s_blocksize to loff_t before the AND operation. 64-bit kernels are unaffected.
Other vulnerabilities in Linux kernel (ocfs2)
See all- CVE-2026-89496Unknown
In the Linux kernel, the ocfs2 filesystem has a memory leak during copy-on-write operations triggered by copy_file_range() within the same filesystem. The issue was found by fuzzing and occurs because deallocations are not always run on copy-on-write completion, leading to unreferenced memory allocations.
- CVE-2026-89494Unknown
In the Linux kernel, the ocfs2 dlm_mig_lockres_handler trusted the num_locks and lockname_len fields from a DLM_MIG_LOCKRES message without validation. This led to an out-of-bounds read (BUG_ON panic) and a heap out-of-bounds write when copying the lock name into a fixed 32-byte object. Any node in the domain could trigger this.
- CVE-2026-89493Unknown
The Linux kernel ocfs2 module lacked validation of the rl_used and rl_count fields in the refcount block. A crafted or corrupted ocfs2 image with rl_used set to 0xffff causes an out-of-bounds read past the metadata block and a subsequent out-of-bounds memmove during a reflink (FICLONE) operation. Exploitation requires local access (CAP_SYS_ADMIN mounting a crafted image or raw write to the backing block device).
- CVE-2026-89492Unknown
A vulnerability was found in the Linux kernel's ocfs2 module due to missing validation of directory-index entry counts when reading metadata. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() do not bound the de_num_used and de_count fields against the block capacity, allowing a crafted on-disk image to set them to 0xffff and cause an out-of-bounds read past the 4KB metadata block. The flaw is reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), the directory cookie position is rebuilt with ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) | offset; `ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is unsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask ~(sb->s_blocksize - 1) is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB block size). In the AND expression with the 64-bit `ctx->pos`, that unsigned operand is zero-extended to 64 bits per the usual arithmetic conversions, yielding 0x00000000fffff000. The high 32 bits of `ctx->pos` are silently cleared, even though directory size is allowed to exceed 4 GiB. When readdir() crosses the 4 GiB boundary on a 32-bit kernel the position is reset back into the first 4 GiB block, making the re-validation path re-enumerate already-returned dirents indefinitely. This is ocfs2_dir_foreach_blk_el(), the extent-list readdir path taken for all non-inline directories, so a directory large enough to cross 4 GiB reaches it. This is the same class of bug that commit 3dce5bb82c97 ("exfat: Fix bitwise operation having different size") fixed in exfat, and the fix mirrors the equivalent ext4 fix in this series. Cast the operand to loff_t so the mask is 64-bit before the AND: ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) | offset; 64-bit kernels are unaffected.