From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D1F4583AC4 for ; Fri, 11 Sep 2026 19:52:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156379; cv=none; b=l7RiviiGtx4lA7a3GelUV6y3gnzSfEu/5i0/THU5BVzsnHMZruqILz1HHfs7UrLFJ8cl8rUaVAeOGU3/ZGWI3yGw63QpHe65RAGEq/MAO1GSdwEmJcz+c76WEWDRmwi6KhmZIGsMrL2/QGRv7mCajyJm+i/+X2qTfR7bjb/fVtE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156379; c=relaxed/simple; bh=nTJbTJ/BIe6jPP+Sd+5ONX7VKB1dFHVwqWjZ+qrfWXI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=RvrUjFVQ2NdvTHzD6rWnX5XLtBE1BMywbxH46XioyjjKdppCkNsxhm0ZFjtyjxG2m96veF3uEGpZvnPck3gw1Mubi5Fzp65fB85L+iTXl045jAXGPwZ6VsvFZlEP6L+E9mlEPYvNcpVhWXOhi6QQitgT5k3gZnGz1TA8FcpHkQ8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=EfFkrcXl; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="EfFkrcXl" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D85021F0089C; Fri, 11 Sep 2026 19:52:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156360; bh=YfNxfwGDqI/cLifMlWZm1YkuqcAenVclc5g70S1Rm9I=; h=From:To:Cc:Subject:Date:Reply-To; b=EfFkrcXlDA7CO5C/MHQbhumRlbqUxbqqYdHIuNAVUVTxyYBmjo5XDr843W85gYm6/ +kIK4Ex7vCvuedQU/P85RkFROnSBlmNoxvQj1Bz5511W4KJeDABo+XgViJwLFsZm9b oH0jHKMwGDhvFATtThunbVLowWWTulHTRjuLMCkY= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89492: ocfs2: validate directory-index entry counts when reading metadata Date: Fri, 11 Sep 2026 21:43:01 +0200 Message-ID: <2026091108-CVE-2026-89492-3f70@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3643; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=i9uLTZlGxvfmbIxqjH+GSIx5ezo4NPGTENG1cdrze1M=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIkNeXRKSOxxeLsJVytjF/i/81aKbrjP19GJ1Fy6q/ XFiSkxGRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEykZirDgps1mX7GMyI6v7s3 /yxQF/mdpeFuzTA/1ff1p7m/1UP/qgU+KorUi9ecUHwbAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate directory-index entry counts when reading metadata ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and signature of an indexed-directory block before it reaches higher-level callers, but neither validator bounds the ocfs2_dx_entry_list counts against the capacity of the block that holds them. ocfs2_dx_dir_search() then walks for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) dx_entry = &entry_list->de_entries[i]; over de_num_used entries with no bounds check. entry_list is either dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root, dx_root->dr_entries. A crafted on-disk image can set de_num_used (and de_count, which is the __counted_by_le() bound of de_entries) to 0xffff and make the walk read far past the end of the 4KB metadata block, giving a slab out-of-bounds read reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted. Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read") already bounds dr_list for the non-inline dx_root, but left the inline dr_entries path and the dx_leaf dl_list unchecked. Add the same read-time validation for both entry lists: de_count must equal the capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and de_num_used must not exceed de_count, rejecting corrupted metadata with -EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry array. de_count is always written as exactly the block capacity when a leaf or inline root is formatted, so the equality check does not reject any valid image. Found by 0sec automated security-research tooling (https://0sec.ai). The Linux kernel CVE team has assigned CVE-2026-89492 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.30 with commit 9b7895efac906d66d19856194e1ba61f37e231a4 and fixed in 6.18.51 with commit fcfcba8fe17dbf2c8805690b8cc25e32d81249a4 Issue introduced in 2.6.30 with commit 9b7895efac906d66d19856194e1ba61f37e231a4 and fixed in 7.2.4 with commit b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed Issue introduced in 2.6.30 with commit 9b7895efac906d66d19856194e1ba61f37e231a4 and fixed in 7.3-rc1 with commit bc70726ddad53c7e9a9a85915bf2415b0d4f42f9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89492 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/dir.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4 https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9