CVE-2026-72162: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

CVE-2026-72162: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[BUG]
On-disk corruption setting l_next_free_rec to 0 in an inode's embedded
extent list triggers a UBSAN panic on the next write to that file.

[CAUSE]
ocfs2_sum_rightmost_rec() computes
i = le16_to_cpu(el->l_next_free_rec) - 1
and accesses el->l_recs[i] without validating i. When l_next_free_rec
is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls
past the end of the array. Either case violates the
__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.

[FIX]
Validate the inode's embedded extent list when the inode is read, in
ocfs2_validate_inode_block(): l_count must be non-zero and no larger
than the inode block can hold, and l_next_free_rec must not exceed
l_count. A corrupt list is rejected at read time, before the b-tree
code can index l_recs[] out of bounds.

The Linux kernel CVE team has assigned CVE-2026-72162 to this issue.


Affected and fixed versions
===========================

	Fixed in 6.18.40 with commit 671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1
	Fixed in 7.1.5 with commit 858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85
	Fixed in 7.2-rc1 with commit 452a8467be8143747292218212671deeb186d2ae

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72162
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ocfs2/inode.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1
	https://git.kernel.org/stable/c/858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85
	https://git.kernel.org/stable/c/452a8467be8143747292218212671deeb186d2ae