GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89493 (GCVE-0-2026-89493)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
ocfs2: validate rl_used against rl_count in refcount block validator
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate rl_used against rl_count in refcount block validator ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array with: for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) { rec = &rb->rf_records.rl_recs[i]; ... rl_recs[] lives in a single metadata block (4096 bytes on the common configuration), so its real capacity is fixed by ocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the 16-byte ocfs2_refcount_rec). rl_used and rl_count are both read directly off disk by ocfs2_validate_refcount_block() and are never checked against that capacity, nor against each other, before any refcount/reflink/CoW operation walks the array. A crafted (or corrupted) refcount block with rl_used == 0xffff makes the loop above walk far past the end of the block, dereferencing rl_recs[i] for i up to 65534. The resulting index is then handed to the sibling ocfs2_insert_refcount_rec(), whose insert-shift does: if (index < le16_to_cpu(rf_list->rl_used)) memmove(&rf_list->rl_recs[index + 1], &rf_list->rl_recs[index], (le16_to_cpu(rf_list->rl_used) - index) * sizeof(struct ocfs2_refcount_rec)); i.e. a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an offset already past the block. This is reachable from an ordinary reflink (FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent whose cpos sorts past every real record in the leaf forces the lookup to run off the end instead of returning early on a match. The attacker model is local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a raw write to the block device backing an already-mounted ocfs2 filesystem. ocfs2_validate_refcount_block() already validates the block's ECC, signature, rf_blkno and rf_fs_generation, but never rl_count/rl_used against the block's actual on-disk capacity. This is the same class of gap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c) already closes for the sibling extent-list header, which checks both the record capacity and the "used" bound before any code walks h_list.l_recs[]: if (le16_to_cpu(eb->h_list.l_count) != ocfs2_extent_recs_per_eb(sb)) { rc = ocfs2_error(...); goto bail; } if (le16_to_cpu(eb->h_list.l_next_free_rec) > le16_to_cpu(eb->h_list.l_count)) { rc = ocfs2_error(...); goto bail; } Add the equivalent pair of checks to ocfs2_validate_refcount_block(): reject a refcount block whose rl_count does not match the fixed per-block capacity returned by ocfs2_refcount_recs_per_rb(), and reject rl_used > rl_count. Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set, because in that case the same union bytes hold an ocfs2_extent_list (rf_list), not the refcount record list (rf_records) -- that layout is already validated separately by ocfs2_validate_extent_block() when the referenced extent block is read. This mirrors the existing "!(rb->rf_flags & OCFS2_REFCOUNT_TREE_FL)" guard used elsewhere in this file (e.g. ocfs2_get_refcount_rec()) to decide whether rf_records or rf_list is the live member of the union. With this in place, a forged rl_used/rl_count is caught at block validation time (ocfs2_error()), consistent with every other corruption check in this function, instead of driving an out-of-bounds read in ocfs2_find_refcount_rec_in_rl() and a subsequent out-of-bounds memmove() in ocfs2_insert_refcount_rec(). Verified against a crafted image on a v6.19 KASAN (KASAN_GENERIC) build: replaying the same reflink (FICLONE) reliably hit a KASAN report in __ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() before this patch, and triggers no report once ocfs2_validate_refcount_block() rejects the forged rl_used/rl_count.
Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < f882e9e32d017a6569b2996c63ba3864717788e6 (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < 5593b63028cb43a6cda75a65ce1db95f00ea6857 (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < c8b02f4ee91e757b3fff556c7168b24b7ae55132 (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < 97584e93fc49a2d59252ac60467e9279f11b1b5b (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < af56e90cb546cb0c47bef059335365283f61d6a4 (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < 0761d2c9494424469a0d30a9da3496ca010b0b2d (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < 04ead708e13ddcb9c39319cbe02a18cef99cb823 (git)
Affected: f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 , < 4ca62df6bc0708947b48da3f6a712ecb8e73929c (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.32
Unaffected: 0 , < 2.6.32 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/refcounttree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f882e9e32d017a6569b2996c63ba3864717788e6",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "5593b63028cb43a6cda75a65ce1db95f00ea6857",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "c8b02f4ee91e757b3fff556c7168b24b7ae55132",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "97584e93fc49a2d59252ac60467e9279f11b1b5b",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "af56e90cb546cb0c47bef059335365283f61d6a4",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "0761d2c9494424469a0d30a9da3496ca010b0b2d",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "04ead708e13ddcb9c39319cbe02a18cef99cb823",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            },
            {
              "lessThan": "4ca62df6bc0708947b48da3f6a712ecb8e73929c",
              "status": "affected",
              "version": "f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/refcounttree.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.32"
            },
            {
              "lessThan": "2.6.32",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.32",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate rl_used against rl_count in refcount block validator\n\nocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array\nwith:\n\n\tfor (; i \u003c le16_to_cpu(rb-\u003erf_records.rl_used); i++) {\n\t\trec = \u0026rb-\u003erf_records.rl_recs[i];\n\t\t...\n\nrl_recs[] lives in a single metadata block (4096 bytes on the common\nconfiguration), so its real capacity is fixed by\nocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the\n16-byte ocfs2_refcount_rec).  rl_used and rl_count are both read directly\noff disk by ocfs2_validate_refcount_block() and are never checked against\nthat capacity, nor against each other, before any refcount/reflink/CoW\noperation walks the array.\n\nA crafted (or corrupted) refcount block with rl_used == 0xffff makes the\nloop above walk far past the end of the block, dereferencing rl_recs[i]\nfor i up to 65534.  The resulting index is then handed to the sibling\nocfs2_insert_refcount_rec(), whose insert-shift does:\n\n\tif (index \u003c le16_to_cpu(rf_list-\u003erl_used))\n\t\tmemmove(\u0026rf_list-\u003erl_recs[index + 1],\n\t\t\t\u0026rf_list-\u003erl_recs[index],\n\t\t\t(le16_to_cpu(rf_list-\u003erl_used) - index) *\n\t\t\t sizeof(struct ocfs2_refcount_rec));\n\ni.e.  a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an\noffset already past the block.  This is reachable from an ordinary reflink\n(FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent\nwhose cpos sorts past every real record in the leaf forces the lookup to\nrun off the end instead of returning early on a match.  The attacker model\nis local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a\nraw write to the block device backing an already-mounted ocfs2 filesystem.\n\nocfs2_validate_refcount_block() already validates the block\u0027s ECC,\nsignature, rf_blkno and rf_fs_generation, but never rl_count/rl_used\nagainst the block\u0027s actual on-disk capacity.  This is the same class of\ngap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c) already closes\nfor the sibling extent-list header, which checks both the record capacity\nand the \"used\" bound before any code walks h_list.l_recs[]:\n\n\tif (le16_to_cpu(eb-\u003eh_list.l_count) != ocfs2_extent_recs_per_eb(sb)) {\n\t\trc = ocfs2_error(...);\n\t\tgoto bail;\n\t}\n\n\tif (le16_to_cpu(eb-\u003eh_list.l_next_free_rec) \u003e\n\t    le16_to_cpu(eb-\u003eh_list.l_count)) {\n\t\trc = ocfs2_error(...);\n\t\tgoto bail;\n\t}\n\nAdd the equivalent pair of checks to ocfs2_validate_refcount_block():\nreject a refcount block whose rl_count does not match the fixed per-block\ncapacity returned by ocfs2_refcount_recs_per_rb(), and reject rl_used \u003e\nrl_count.  Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set,\nbecause in that case the same union bytes hold an ocfs2_extent_list\n(rf_list), not the refcount record list (rf_records) -- that layout is\nalready validated separately by ocfs2_validate_extent_block() when the\nreferenced extent block is read.  This mirrors the existing\n\"!(rb-\u003erf_flags \u0026 OCFS2_REFCOUNT_TREE_FL)\" guard used elsewhere in this\nfile (e.g.  ocfs2_get_refcount_rec()) to decide whether rf_records or\nrf_list is the live member of the union.\n\nWith this in place, a forged rl_used/rl_count is caught at block\nvalidation time (ocfs2_error()), consistent with every other corruption\ncheck in this function, instead of driving an out-of-bounds read in\nocfs2_find_refcount_rec_in_rl() and a subsequent out-of-bounds memmove()\nin ocfs2_insert_refcount_rec().\n\nVerified against a crafted image on a v6.19 KASAN (KASAN_GENERIC) build:\nreplaying the same reflink (FICLONE) reliably hit a KASAN report in\n__ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() before this patch,\nand triggers no report once ocfs2_validate_refcount_block() rejects the\nforged rl_used/rl_count."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - OCFS2 registers export_operations and is commonly NFS-exported or ksmbd-shared on cluster storage; remote NFSv4.2 CLONE or ksmbd FSCTL_DUPLICATE_EXTENTS reaches vfs_clone_file_range\u2192ocfs2_remap_file_range, and NFS WRITE/truncate on refcounted files reaches ocfs2_get_refcount_rec() and the OOB walk/memmove.\nAC:L - A crafted refcount block with rl_used=0xffff plus FICLONE/clone or write/CoW whose cpos sorts past the real leaf records deterministically drives the OOB loop and memmove; the fix commit reproduced this under KASAN with no race or uncontrollable layout.\nPR:L - Triggering needs only write/clone permission on a file whose inode points at the forged refcount block (unprivileged local user or authenticated NFS/SMB client); ocfs2_remap_file_range and ocfs2_reflink_ioctl have no capability check, and planting on-disk metadata does not require init-namespace root.\nUI:N - Once the malformed refcount block is on an already-mounted or NFS/SMB-exported OCFS2 volume, the attacker issues clone, write, or truncate themselves; no separate victim mount, click, or administrator action is required at exploit time.\nS:U - The out-of-bounds read and write corrupt kernel memory in the host parsing the OCFS2 refcount block; impact stays within that kernel\u0027s security authority and does not cross a VM, container, or IOMMU boundary.\nC:H - ocfs2_find_refcount_rec_in_rl() indexes rl_recs[i] for i up to 65534 past a single 4K metadata block, performing an approximately 1 MiB out-of-bounds read of adjacent kernel memory and enabling high-bandwidth disclosure.\nI:H - ocfs2_insert_refcount_rec() memmove()s up to (0xffff-index)*16 bytes (~1 MiB) from and to offsets already past the block and writes rl_recs[index] out of bounds, which is an arbitrary kernel out-of-bounds write exploitable for control-flow hijacking.\nA:H - The same OOB access was reproduced as a KASAN fault in __ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() and causes a kernel oops or panic, fully denying availability on the affected node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:27.844Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f882e9e32d017a6569b2996c63ba3864717788e6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5593b63028cb43a6cda75a65ce1db95f00ea6857"
        },
        {
          "url": "https://git.kernel.org/stable/c/c8b02f4ee91e757b3fff556c7168b24b7ae55132"
        },
        {
          "url": "https://git.kernel.org/stable/c/97584e93fc49a2d59252ac60467e9279f11b1b5b"
        },
        {
          "url": "https://git.kernel.org/stable/c/af56e90cb546cb0c47bef059335365283f61d6a4"
        },
        {
          "url": "https://git.kernel.org/stable/c/0761d2c9494424469a0d30a9da3496ca010b0b2d"
        },
        {
          "url": "https://git.kernel.org/stable/c/04ead708e13ddcb9c39319cbe02a18cef99cb823"
        },
        {
          "url": "https://git.kernel.org/stable/c/4ca62df6bc0708947b48da3f6a712ecb8e73929c"
        }
      ],
      "title": "ocfs2: validate rl_used against rl_count in refcount block validator",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89493",
    "datePublished": "2026-09-11T19:43:44.803Z",
    "dateReserved": "2026-09-11T19:38:34.714Z",
    "dateUpdated": "2026-09-14T12:00:27.844Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89493",
      "date": "2026-09-17",
      "epss": "0.00632",
      "percentile": "0.4873"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:48:56.000Z",
      "cve": "CVE-2026-89493",
      "id": "msrc_CVE-2026-89493",
      "initial_release_date": "2026-09-13T01:03:20.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: validate rl_used against rl_count in refcount block validator",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89493.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89493\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:31.220\",\"lastModified\":\"2026-09-14T13:19:06.250\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: validate rl_used against rl_count in refcount block validator\\n\\nocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array\\nwith:\\n\\n\\tfor (; i \u003c le16_to_cpu(rb-\u003erf_records.rl_used); i++) {\\n\\t\\trec = \u0026rb-\u003erf_records.rl_recs[i];\\n\\t\\t...\\n\\nrl_recs[] lives in a single metadata block (4096 bytes on the common\\nconfiguration), so its real capacity is fixed by\\nocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the\\n16-byte ocfs2_refcount_rec).  rl_used and rl_count are both read directly\\noff disk by ocfs2_validate_refcount_block() and are never checked against\\nthat capacity, nor against each other, before any refcount/reflink/CoW\\noperation walks the array.\\n\\nA crafted (or corrupted) refcount block with rl_used == 0xffff makes the\\nloop above walk far past the end of the block, dereferencing rl_recs[i]\\nfor i up to 65534.  The resulting index is then handed to the sibling\\nocfs2_insert_refcount_rec(), whose insert-shift does:\\n\\n\\tif (index \u003c le16_to_cpu(rf_list-\u003erl_used))\\n\\t\\tmemmove(\u0026rf_list-\u003erl_recs[index + 1],\\n\\t\\t\\t\u0026rf_list-\u003erl_recs[index],\\n\\t\\t\\t(le16_to_cpu(rf_list-\u003erl_used) - index) *\\n\\t\\t\\t sizeof(struct ocfs2_refcount_rec));\\n\\ni.e.  a memmove() of up to (0xffff - index) * 16 bytes (~1 MiB) from an\\noffset already past the block.  This is reachable from an ordinary reflink\\n(FICLONE) against a crafted/corrupted ocfs2 image: attaching an extent\\nwhose cpos sorts past every real record in the leaf forces the lookup to\\nrun off the end instead of returning early on a match.  The attacker model\\nis local: CAP_SYS_ADMIN mounting a crafted or corrupted ocfs2 image, or a\\nraw write to the block device backing an already-mounted ocfs2 filesystem.\\n\\nocfs2_validate_refcount_block() already validates the block\u0027s ECC,\\nsignature, rf_blkno and rf_fs_generation, but never rl_count/rl_used\\nagainst the block\u0027s actual on-disk capacity.  This is the same class of\\ngap that ocfs2_validate_extent_block() (fs/ocfs2/alloc.c) already closes\\nfor the sibling extent-list header, which checks both the record capacity\\nand the \\\"used\\\" bound before any code walks h_list.l_recs[]:\\n\\n\\tif (le16_to_cpu(eb-\u003eh_list.l_count) != ocfs2_extent_recs_per_eb(sb)) {\\n\\t\\trc = ocfs2_error(...);\\n\\t\\tgoto bail;\\n\\t}\\n\\n\\tif (le16_to_cpu(eb-\u003eh_list.l_next_free_rec) \u003e\\n\\t    le16_to_cpu(eb-\u003eh_list.l_count)) {\\n\\t\\trc = ocfs2_error(...);\\n\\t\\tgoto bail;\\n\\t}\\n\\nAdd the equivalent pair of checks to ocfs2_validate_refcount_block():\\nreject a refcount block whose rl_count does not match the fixed per-block\\ncapacity returned by ocfs2_refcount_recs_per_rb(), and reject rl_used \u003e\\nrl_count.  Both checks are skipped when OCFS2_REFCOUNT_TREE_FL is set,\\nbecause in that case the same union bytes hold an ocfs2_extent_list\\n(rf_list), not the refcount record list (rf_records) -- that layout is\\nalready validated separately by ocfs2_validate_extent_block() when the\\nreferenced extent block is read.  This mirrors the existing\\n\\\"!(rb-\u003erf_flags \u0026 OCFS2_REFCOUNT_TREE_FL)\\\" guard used elsewhere in this\\nfile (e.g.  ocfs2_get_refcount_rec()) to decide whether rf_records or\\nrf_list is the live member of the union.\\n\\nWith this in place, a forged rl_used/rl_count is caught at block\\nvalidation time (ocfs2_error()), consistent with every other corruption\\ncheck in this function, instead of driving an out-of-bounds read in\\nocfs2_find_refcount_rec_in_rl() and a subsequent out-of-bounds memmove()\\nin ocfs2_insert_refcount_rec().\\n\\nVerified against a crafted image on a v6.19 KASAN (KASAN_GENERIC) build:\\nreplaying the same reflink (FICLONE) reliably hit a KASAN report in\\n__ocfs2_increase_refcount()/ocfs2_insert_refcount_rec() before this patch,\\nand triggers no report once ocfs2_validate_refcount_block() rejects the\\nforged rl_used/rl_count.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ocfs2/refcounttree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"f882e9e32d017a6569b2996c63ba3864717788e6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"5593b63028cb43a6cda75a65ce1db95f00ea6857\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"c8b02f4ee91e757b3fff556c7168b24b7ae55132\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"97584e93fc49a2d59252ac60467e9279f11b1b5b\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"af56e90cb546cb0c47bef059335365283f61d6a4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"0761d2c9494424469a0d30a9da3496ca010b0b2d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"04ead708e13ddcb9c39319cbe02a18cef99cb823\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4\",\"lessThan\":\"4ca62df6bc0708947b48da3f6a712ecb8e73929c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ocfs2/refcounttree.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.32\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.32\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/04ead708e13ddcb9c39319cbe02a18cef99cb823\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/0761d2c9494424469a0d30a9da3496ca010b0b2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4ca62df6bc0708947b48da3f6a712ecb8e73929c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/5593b63028cb43a6cda75a65ce1db95f00ea6857\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/97584e93fc49a2d59252ac60467e9279f11b1b5b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af56e90cb546cb0c47bef059335365283f61d6a4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c8b02f4ee91e757b3fff556c7168b24b7ae55132\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f882e9e32d017a6569b2996c63ba3864717788e6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-13T06:56:28+00:00",
      "cve": "CVE-2026-89493",
      "id": "CVE-2026-89493",
      "initial_release_date": "2026-09-11T19:43:44.803000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: Memory corruption due to insufficient refcount block validation",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89493.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:54Z",
      "cve": "CVE-2026-89493",
      "id": "CVE-2026-89493",
      "initial_release_date": "2026-09-16T00:02:54Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89493",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89493.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.