From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C18F835F197 for ; Sat, 15 Aug 2026 06:14:30 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774471; cv=none; b=HKzTop6bChqAiLtTMHpPz6I0Ijy2JpB3fmdEtzXk0pv1G1a7BVBfKMG81P1qLJTtpGhBYoStxrE0hJ04gcQCNl25WOCTtcvcvOPVO/mDgPL6/xE4pZDPMkg1vy0ZfkflzI3wC5qYg+DhjiTWtma4aHZIUSpN4JAsaxZkpBmWzRY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786774471; c=relaxed/simple; bh=MZw5Mrqdp3lxSrf/fNuhHoMA7ZDmuW5n+I3wHqqsnv8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=FmJLJjXgOcKCsRYrcG2K4DVgf5E2egfAQJJMLRyKRhTPkITli+C4q3QFcgIZGhG9GAwSgNUSs+8tKpoVa2Z+3uV1WT0kLhCyvbR0s/c0PD3YuPmIUgLKfX23yvHj7BB1nvr76ZMok5lc6qWpExluHMAYrz7Rv3fmHpFvhyXk0mE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bcM5QNi7; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bcM5QNi7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 25CC81F000E9; Sat, 15 Aug 2026 06:14:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786774470; bh=+qa58S/1v9r7X7elL426hnmMJblr9LZ/WayjWQqEXvA=; h=From:To:Cc:Subject:Date:Reply-To; b=bcM5QNi7A8MxuxdK0BUiQMP5logxpItbFo3b2ubr3vmOLM6q3YBqWT40a9hjrWXo4 3IdLfMSYDLke6Pqu8MvJ8jNie+s1KTfqmCX1LMfxbcmD6vOP79U8wWT7lyE2ZGxjFa Jv8Q9CEwvHaDrgcfkiQaJ20ggPya/JQcTWQxYp/4= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-72164: ocfs2: avoid moving extents to occupied clusters Date: Sat, 15 Aug 2026 15:04:03 +0900 Message-ID: <2026081536-CVE-2026-72164-c600@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4116; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=07JBQhewOAHLrrgXQYOg7PKPZLey2u5jdjYkKxiQqr0=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkNDAfmis5zZVM+/uBT6M55h7YEFO9Z/+GIn/HmY4rPf R8ouE6/1hHLwiDIxCArpsjyZRvP0f0VhxS9DG1Pw8xhZQIZwsDFKQATaWBlWHDxyRxX1lvmSYde lvx0/bo9PEmxMZphfs6dkP/fHwtz2RidE+BdPNV/gnf3WQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: avoid moving extents to occupied clusters For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and expects ocfs2_probe_alloc_group() to replace it with a free run in the target block group. The probe currently leaves *phys_cpos unchanged if the scan reaches the end of the group without finding a free run. An occupied goal at the last bit can therefore survive the probe and be passed to __ocfs2_move_extent(), which copies file data into a cluster still owned by another inode before the bitmap is updated. When the probe does find a free run, it also subtracts move_len from the ending bit. The start of an N-bit run ending at i is i - N + 1, so the current calculation can report the bit immediately before the free run. Clear *phys_cpos before scanning and use the correct free-run start. Callers already treat a zero result as -ENOSPC, so failed probes no longer continue with an occupied caller-controlled goal. The Linux kernel CVE team has assigned CVE-2026-72164 to this issue. Affected and fixed versions =========================== Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 5.10.261 with commit 3112afebf2a76e522fbaabcbb0c47aafbdc35932 Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 5.15.212 with commit 35486b291b8fbde6c4d0b1c79e565c6260d3329d Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 6.1.178 with commit 19f7b04924b20b81dabbeed19d5542792ba5b6d6 Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 6.6.145 with commit e281d892ce5870a50fdc718cb3bfc3dd5b62c728 Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 6.12.97 with commit 0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 6.18.40 with commit d5d5a21fb33cd9b963aea99da81e4dacd452cd95 Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 7.1.5 with commit 4d1953d3aeb4a7f6623083e1839068ee1c157db2 Issue introduced in 3.0 with commit e6b5859cccfa0fec02f3c5b1069481efc7186f47 and fixed in 7.2-rc1 with commit 22920541c35a9f23f219038ba5874c843a7c4419 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-72164 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/move_extents.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3112afebf2a76e522fbaabcbb0c47aafbdc35932 https://git.kernel.org/stable/c/35486b291b8fbde6c4d0b1c79e565c6260d3329d https://git.kernel.org/stable/c/19f7b04924b20b81dabbeed19d5542792ba5b6d6 https://git.kernel.org/stable/c/e281d892ce5870a50fdc718cb3bfc3dd5b62c728 https://git.kernel.org/stable/c/0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e https://git.kernel.org/stable/c/d5d5a21fb33cd9b963aea99da81e4dacd452cd95 https://git.kernel.org/stable/c/4d1953d3aeb4a7f6623083e1839068ee1c157db2 https://git.kernel.org/stable/c/22920541c35a9f23f219038ba5874c843a7c4419