CVE-2026-90205 (GCVE-0-2026-90205)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:07 – Updated: 2026-09-18 17:53
VLAI
Title
ocfs2: validate orphan slot during inode read
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate orphan slot during inode read Patch series "ocfs2: validate active orphan slots during inode read". OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes. A corrupted slot can therefore index osb_orphan_wipes or the slot-local system-inode cache outside their allocations before the corruption is reported. Patch 1 validates the ordinary orphan slot used by inode wipe processing. Patch 2 validates the append-DIO orphan slot used by DIO completion and orphan recovery. Both checks reject corrupt metadata at the existing inode validation boundary. This patch (of 2): [BUG] A corrupted dinode with OCFS2_ORPHANED_FL can carry an i_orphaned_slot outside the mounted filesystem slot range. ocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking up the orphan directory, causing an out-of-bounds memory access. BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline] ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ... [CAUSE] ocfs2_validate_inode_block() validates i_suballoc_slot but leaves the active ordinary orphan slot unchecked. Downstream consumers assume that the value is smaller than osb->max_slots. [FIX] Reject an active i_orphaned_slot outside the slot range during dinode validation, before the inode reaches orphan wipe processing.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b4df6ed8db0c387d38292e31f00adc4cd297ed5a , < c6c908f9b4edfb04534b15573168ae038f7a9cbf (git)
Affected: b4df6ed8db0c387d38292e31f00adc4cd297ed5a , < 3d7c4b7ce7b4baedfd8699fa692cd95f77d332de (git)
Affected: b4df6ed8db0c387d38292e31f00adc4cd297ed5a , < b2d31acbd3b182755b019183fb46949ba5e39b9f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.16
Unaffected: 0 , < 2.6.16 (semver)
Unaffected: 6.18.52 , ≤ 6.18.* (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "c6c908f9b4edfb04534b15573168ae038f7a9cbf",
              "status": "affected",
              "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
              "versionType": "git"
            },
            {
              "lessThan": "3d7c4b7ce7b4baedfd8699fa692cd95f77d332de",
              "status": "affected",
              "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
              "versionType": "git"
            },
            {
              "lessThan": "b2d31acbd3b182755b019183fb46949ba5e39b9f",
              "status": "affected",
              "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate orphan slot during inode read\n\nPatch series \"ocfs2: validate active orphan slots during inode read\".\n\nOCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.\nA corrupted slot can therefore index osb_orphan_wipes or the slot-local\nsystem-inode cache outside their allocations before the corruption is\nreported.\n\nPatch 1 validates the ordinary orphan slot used by inode wipe processing.\nPatch 2 validates the append-DIO orphan slot used by DIO completion and\norphan recovery.  Both checks reject corrupt metadata at the existing inode\nvalidation boundary.\n\n\nThis patch (of 2):\n\n[BUG]\nA corrupted dinode with OCFS2_ORPHANED_FL can carry an\ni_orphaned_slot outside the mounted filesystem slot range.\nocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking\nup the orphan directory, causing an out-of-bounds memory access.\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_validate_inode_block() validates i_suballoc_slot but leaves\nthe active ordinary orphan slot unchecked. Downstream consumers\nassume that the value is smaller than osb-\u003emax_slots.\n\n[FIX]\nReject an active i_orphaned_slot outside the slot range during\ndinode validation, before the inode reaches orphan wipe processing."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker-controlled field is dinode i_orphaned_slot, read from the mounted block device in ocfs2_validate_inode_block()/ocfs2_read_locked_inode() and consumed by ocfs2_wipe_inode(); it is not a field of an o2net, NFS, or SMB message. Delivery is a locally mounted OCFS2 image (loop or other block device).\nAC:L - A crafted dinode with OCFS2_ORPHANED_FL and an attacker-chosen i_orphaned_slot is accepted before the fix. ocfs2_fill_super() calls ocfs2_complete_mount_recovery(), which queues ocfs2_recover_orphans(); that igets the orphan and iputs it into ocfs2_evict_inode()\u2192ocfs2_wipe_inode() with no race.\nPR:N - ocfs2_fs_type.fs_flags has no FS_USERNS_MOUNT, so only a privileged mount(2) via ocfs2_get_tree()/ocfs2_fill_super() reaches recovery. The attacker who supplies the image needs no host credentials; unlink cannot plant this value because ocfs2_orphan_add() writes osb-\u003eslot_num.\nUI:R - The bug fires from ocfs2_complete_recovery()\u2192ocfs2_recover_orphans() after the victim mounts the crafted volume through ocfs2_fill_super(). That mount is the required user action and cannot be treated as a standing export of already-on-disk metadata.\nS:U - The out-of-bounds accesses in ocfs2_check_orphan_recovery_state() and get_local_system_inode() corrupt memory in the kernel that mounted the OCFS2 volume. No KVM, Xen, or IOMMU boundary is crossed.\nC:H - get_local_system_inode() computes index = i_orphaned_slot * NUM_LOCAL_SYSTEM_INODES and reads an 8-byte inode pointer past the kcalloc\u0027d local_system_inodes array (KASAN UAF read in ocfs2_get_system_file_inode). A non-NULL value is passed to igrab(), disclosing adjacent slab contents.\nI:H - ocfs2_check_orphan_recovery_state() does osb-\u003eosb_orphan_wipes[slot]++ with the untrusted i_orphaned_slot against a kcalloc(max_slots) array (max_slots \u2264 255), a heap out-of-bounds increment. The OOB pointer is then used as an inode in inode_lock/ocfs2_inode_lock.\nA:H - ocfs2_node_map_test_bit() BUG()s when i_orphaned_slot \u003e= OCFS2_NODE_MAP_MAX_NODES (256). Smaller out-of-range slots still OOB-index osb_orphan_wipes[] and local_system_inodes[], which KASAN reported as slab-use-after-free during ocfs2_recover_orphans() in ocfs2_complete_recovery()."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:53:44.119Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/c6c908f9b4edfb04534b15573168ae038f7a9cbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/3d7c4b7ce7b4baedfd8699fa692cd95f77d332de"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2d31acbd3b182755b019183fb46949ba5e39b9f"
        }
      ],
      "title": "ocfs2: validate orphan slot during inode read",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90205",
    "datePublished": "2026-09-17T16:07:21.521Z",
    "dateReserved": "2026-09-11T19:38:34.793Z",
    "dateUpdated": "2026-09-18T17:53:44.119Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90205",
      "date": "2026-09-25",
      "epss": "0.00179",
      "percentile": "0.06655"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-23T01:57:01.000Z",
      "cve": "CVE-2026-90205",
      "id": "msrc_CVE-2026-90205",
      "initial_release_date": "2026-09-19T01:12:52.000Z",
      "product_status:known_affected": "2",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: validate orphan slot during inode read",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90205.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "c6c908f9b4edfb04534b15573168ae038f7a9cbf",
                    "status": "affected",
                    "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3d7c4b7ce7b4baedfd8699fa692cd95f77d332de",
                    "status": "affected",
                    "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b2d31acbd3b182755b019183fb46949ba5e39b9f",
                    "status": "affected",
                    "version": "b4df6ed8db0c387d38292e31f00adc4cd297ed5a",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/inode.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "2.6.16"
                  },
                  {
                    "lessThan": "2.6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.52",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate orphan slot during inode read\n\nPatch series \"ocfs2: validate active orphan slots during inode read\".\n\nOCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.\nA corrupted slot can therefore index osb_orphan_wipes or the slot-local\nsystem-inode cache outside their allocations before the corruption is\nreported.\n\nPatch 1 validates the ordinary orphan slot used by inode wipe processing.\nPatch 2 validates the append-DIO orphan slot used by DIO completion and\norphan recovery.  Both checks reject corrupt metadata at the existing inode\nvalidation boundary.\n\n\nThis patch (of 2):\n\n[BUG]\nA corrupted dinode with OCFS2_ORPHANED_FL can carry an\ni_orphaned_slot outside the mounted filesystem slot range.\nocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking\nup the orphan directory, causing an out-of-bounds memory access.\n\nBUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\nRead of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85\nCall Trace:\n ...\n ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102\n ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840\n ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]\n ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295\n evict+0x38e/0x8f0 fs/inode.c:810\n iput_final fs/inode.c:1914 [inline]\n iput fs/inode.c:1966 [inline]\n iput+0x55b/0x8b0 fs/inode.c:1926\n ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374\n ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373\n ...\n\n[CAUSE]\nocfs2_validate_inode_block() validates i_suballoc_slot but leaves\nthe active ordinary orphan slot unchecked. Downstream consumers\nassume that the value is smaller than osb-\u003emax_slots.\n\n[FIX]\nReject an active i_orphaned_slot outside the slot range during\ndinode validation, before the inode reaches orphan wipe processing."
          }
        ],
        "id": "CVE-2026-90205",
        "lastModified": "2026-09-18T18:17:46.420",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "REQUIRED",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:15.573",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3d7c4b7ce7b4baedfd8699fa692cd95f77d332de"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b2d31acbd3b182755b019183fb46949ba5e39b9f"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c6c908f9b4edfb04534b15573168ae038f7a9cbf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-21T16:30:49Z",
      "cve": "CVE-2026-90205",
      "id": "CVE-2026-90205",
      "initial_release_date": "2026-09-18T00:19:59Z",
      "product_status:known_affected": "347",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90205",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90205.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.