GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89492 (GCVE-0-2026-89492)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-13 06:30
VLAI
Title
ocfs2: validate directory-index entry counts when reading metadata
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai).
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 9b7895efac906d66d19856194e1ba61f37e231a4 , < fcfcba8fe17dbf2c8805690b8cc25e32d81249a4 (git)
Affected: 9b7895efac906d66d19856194e1ba61f37e231a4 , < b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed (git)
Affected: 9b7895efac906d66d19856194e1ba61f37e231a4 , < bc70726ddad53c7e9a9a85915bf2415b0d4f42f9 (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.30
Unaffected: 0 , < 2.6.30 (semver)
Unaffected: 6.18.51 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "fcfcba8fe17dbf2c8805690b8cc25e32d81249a4",
              "status": "affected",
              "version": "9b7895efac906d66d19856194e1ba61f37e231a4",
              "versionType": "git"
            },
            {
              "lessThan": "b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed",
              "status": "affected",
              "version": "9b7895efac906d66d19856194e1ba61f37e231a4",
              "versionType": "git"
            },
            {
              "lessThan": "bc70726ddad53c7e9a9a85915bf2415b0d4f42f9",
              "status": "affected",
              "version": "9b7895efac906d66d19856194e1ba61f37e231a4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dir.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.30"
            },
            {
              "lessThan": "2.6.30",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.51",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.51",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.30",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate directory-index entry counts when reading metadata\n\nocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and\nsignature of an indexed-directory block before it reaches higher-level\ncallers, but neither validator bounds the ocfs2_dx_entry_list counts\nagainst the capacity of the block that holds them.\n\nocfs2_dx_dir_search() then walks\n\n\tfor (i = 0; i \u003c le16_to_cpu(entry_list-\u003ede_num_used); i++)\n\t\tdx_entry = \u0026entry_list-\u003ede_entries[i];\n\nover de_num_used entries with no bounds check.  entry_list is either\ndx_leaf-\u003edl_list (from ocfs2_read_dx_leaf) or, for an inline root,\ndx_root-\u003edr_entries.  A crafted on-disk image can set de_num_used (and\nde_count, which is the __counted_by_le() bound of de_entries) to 0xffff\nand make the walk read far past the end of the 4KB metadata block, giving\na slab out-of-bounds read reachable from any path lookup, stat() or open()\non an indexed directory once the image is mounted.\n\nCommit 775c17386a6f (\"ocfs2: validate dx_root extent list fields during\nblock read\") already bounds dr_list for the non-inline dx_root, but left\nthe inline dr_entries path and the dx_leaf dl_list unchecked.  Add the\nsame read-time validation for both entry lists: de_count must equal the\ncapacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and\nde_num_used must not exceed de_count, rejecting corrupted metadata with\n-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry\narray.\n\nde_count is always written as exactly the block capacity when a leaf or\ninline root is formatted, so the equality check does not reject any valid\nimage.\n\nFound by 0sec automated security-research tooling (https://0sec.ai)."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - OCFS2 sets s_export_op to ocfs2_export_ops and is commonly NFS-exported on shared cluster LUNs; remote nfsd LOOKUP/GETATTR/CREATE reach ocfs2_lookup\u2192ocfs2_find_entry_dx\u2192ocfs2_dx_dir_search (and create\u2192ocfs2_dx_entry_list_insert) over the network with no local syscall on the server.\nAC:L - The attacker fully controls on-disk de_num_used and de_count in a dx_root or dx_leaf; inflating them above the fixed 4K-block capacity (e.g. 0xffff with de_num_used still below de_count) deterministically overflows the entry walk and insert with no race or attacker-uncontrollable layout.\nPR:N - Triggering needs only NFS LOOKUP or CREATE on an exported directory, including guest or anonymous NFS, or any unprivileged accessor of a mounted volume holding the forged index; planting malformed directory-index metadata on shared cluster storage does not require init-namespace root on the victim.\nUI:N - Once the OCFS2 volume is mounted and NFS-exported as a normal cluster or NAS deployment, the attacker triggers the overflow by their own LOOKUP, stat, open, or CREATE; no additional victim action such as mounting an image or opening a file is required.\nS:U - The overflow corrupts kernel memory and OCFS2 metadata on the host that parses the forged directory index; it does not escape a VM, bypass an IOMMU, or otherwise cross into a separate security authority.\nC:H - ocfs2_dx_dir_search walks de_num_used with no capacity check, so de_num_used of 0xffff reads far past the 4KB metadata block (up to about 1 MiB of adjacent kernel memory), an unbounded out-of-bounds read that enables high-impact disclosure.\nI:H - When de_count is inflated past block capacity and de_num_used is still less than de_count, create/mkdir calls ocfs2_dx_entry_list_insert and writes a dx_entry at de_entries[de_num_used] past the block; unlink memmove is similarly unbounded, yielding an attacker-triggered kernel out-of-bounds write.\nA:H - The unbounded out-of-bounds read on lookup and out-of-bounds write on create against kernel metadata buffers cause a kernel oops or panic, fully denying availability of the OCFS2 node until reboot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-13T06:30:00.175Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed"
        },
        {
          "url": "https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9"
        }
      ],
      "title": "ocfs2: validate directory-index entry counts when reading metadata",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89492",
    "datePublished": "2026-09-11T19:43:44.137Z",
    "dateReserved": "2026-09-11T19:38:34.713Z",
    "dateUpdated": "2026-09-13T06:30:00.175Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89492",
      "date": "2026-09-16",
      "epss": "0.00605",
      "percentile": "0.47377"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89492\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:31.090\",\"lastModified\":\"2026-09-13T07:17:12.417\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: validate directory-index entry counts when reading metadata\\n\\nocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and\\nsignature of an indexed-directory block before it reaches higher-level\\ncallers, but neither validator bounds the ocfs2_dx_entry_list counts\\nagainst the capacity of the block that holds them.\\n\\nocfs2_dx_dir_search() then walks\\n\\n\\tfor (i = 0; i \u003c le16_to_cpu(entry_list-\u003ede_num_used); i++)\\n\\t\\tdx_entry = \u0026entry_list-\u003ede_entries[i];\\n\\nover de_num_used entries with no bounds check.  entry_list is either\\ndx_leaf-\u003edl_list (from ocfs2_read_dx_leaf) or, for an inline root,\\ndx_root-\u003edr_entries.  A crafted on-disk image can set de_num_used (and\\nde_count, which is the __counted_by_le() bound of de_entries) to 0xffff\\nand make the walk read far past the end of the 4KB metadata block, giving\\na slab out-of-bounds read reachable from any path lookup, stat() or open()\\non an indexed directory once the image is mounted.\\n\\nCommit 775c17386a6f (\\\"ocfs2: validate dx_root extent list fields during\\nblock read\\\") already bounds dr_list for the non-inline dx_root, but left\\nthe inline dr_entries path and the dx_leaf dl_list unchecked.  Add the\\nsame read-time validation for both entry lists: de_count must equal the\\ncapacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and\\nde_num_used must not exceed de_count, rejecting corrupted metadata with\\n-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry\\narray.\\n\\nde_count is always written as exactly the block capacity when a leaf or\\ninline root is formatted, so the equality check does not reject any valid\\nimage.\\n\\nFound by 0sec automated security-research tooling (https://0sec.ai).\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ocfs2/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"9b7895efac906d66d19856194e1ba61f37e231a4\",\"lessThan\":\"fcfcba8fe17dbf2c8805690b8cc25e32d81249a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b7895efac906d66d19856194e1ba61f37e231a4\",\"lessThan\":\"b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9b7895efac906d66d19856194e1ba61f37e231a4\",\"lessThan\":\"bc70726ddad53c7e9a9a85915bf2415b0d4f42f9\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ocfs2/dir.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.30\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.30\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.51\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-15T12:46:33+00:00",
      "cve": "CVE-2026-89492",
      "id": "CVE-2026-89492",
      "initial_release_date": "2026-09-11T00:00:00+00:00",
      "product_status:known_not_affected": "276",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: validate directory-index entry counts when reading metadata",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89492.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:55Z",
      "cve": "CVE-2026-89492",
      "id": "CVE-2026-89492",
      "initial_release_date": "2026-09-12T16:27:32Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89492",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89492.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.