From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 18A8735C69E for ; Sat, 15 Aug 2026 06:14:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774463; cv=none; b=iWdhAtV6DARmRqdQFH/7aQ8VW/A712dr0OpJvRpPcl61NHnw4A68iD9v41iXvY38LStqhw/atAq84Y2noFcbmKWCf0q2BBhqXL0aukF1Vox0BUDiQ3631r31k7tQ1ijc4O2bU5WSt5dEUrVPWBiY/4cMqfsupoYCDmfqfgHcgiQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774463; c=relaxed/simple; bh=q8Pl6nNhy7gdtRWyK34mem5w3mDizYppbxukYdqr4ns=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=synttxZWuEYSVWSc4hVPaVXfhzRY2TI/Zap9QGftaf+no3BhgvR5nZH9lG2RCneqhJHpO5PCHDe87RhlFc0MA5O1TKEfms3DDj1a/y94I1OW10+qfsQK7qOU6WPWma2tjiRj9Dyj4bE+e9H1jqCgbKhIrxgrutlPlRJSQuvnWvU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=CzRXf24m; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="CzRXf24m" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70B441F000E9; Sat, 15 Aug 2026 06:14:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786774462; bh=tPUImW2oigGm0uWNglADKjjfT/lwlWCJmDtSe0bjzBY=; h=From:To:Cc:Subject:Date:Reply-To; b=CzRXf24mfGV+HMyLddbpkIoT5jMc2Ftwmm7e+oce63u3DF2VGZ4hr8riy93uDNJ11 lt1NIhmtTjNfMOitlTLoiSSvwqBb7MY3x3yDhxRf3CK9GRTP9pL0GKjCT70M2R067u 1Oun/S2rhvwDm1cTdeWTN1XtAENfkzMRdTp6ufWU= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72161: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() Date: Sat, 15 Aug 2026 15:04:00 +0900 Message-ID: <2026081536-CVE-2026-72161-c625@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3193; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=2k3YBaWO63Ey13NTNkoWg6oh+khyhcHC9HTXIZSE1XI=; b=kA0DAAIRMUfUDdst+ykByyZiAGqAAMChfMY8BA/HTnyGXd4rZLwuU00K0r2/UsRiYkBZ2YVml ohdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmqAAMAACgkQMUfUDdst+ykG2QCeKD1z oKUssQR52RP0J5Rmd5XGZL0AoJaFbZc8F5KP8W9gSOXisNwPgGPs X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint. The Linux kernel CVE team has assigned CVE-2026-72161 to this issue. Affected and fixed versions =========================== Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 6.1.178 with commit 24daf13422e8328fd588c34a017bdef1949910e8 Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 6.6.145 with commit 7da7e4ac21895fe34cceffcfc99497cc2750da99 Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 6.12.97 with commit eb6a13834c23e291f1170cb1b489ec255edfa5a3 Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 6.18.40 with commit 499714de42ab4d2e778cbb10186684142a1222eb Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 7.1.5 with commit 63921f790234b221e4b15c56c72888b13250f81d Issue introduced in 5.16 with commit da5e7c87827e8caa6a1eeec6d95dcf74ab592a01 and fixed in 7.2-rc1 with commit a291c77c034b7a81849ce9b71cc9ecda9e587d89 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72161 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/journal.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/24daf13422e8328fd588c34a017bdef1949910e8 https://git.kernel.org/stable/c/7da7e4ac21895fe34cceffcfc99497cc2750da99 https://git.kernel.org/stable/c/eb6a13834c23e291f1170cb1b489ec255edfa5a3 https://git.kernel.org/stable/c/499714de42ab4d2e778cbb10186684142a1222eb https://git.kernel.org/stable/c/63921f790234b221e4b15c56c72888b13250f81d https://git.kernel.org/stable/c/a291c77c034b7a81849ce9b71cc9ecda9e587d89