{
  "public_date" : "2026-04-24T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: ocfs2: handle invalid dinode in ocfs2_group_extend",
    "id" : "2461550",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=2461550"
  },
  "cwe" : "CWE-1287",
  "details" : [ "In the Linux kernel, the following vulnerability has been resolved:\nocfs2: handle invalid dinode in ocfs2_group_extend\n[BUG]\nkernel BUG at fs/ocfs2/resize.c:308!\nOops: invalid opcode: 0000 [#1] SMP KASAN NOPTI\nRIP: 0010:ocfs2_group_extend+0x10aa/0x1ae0 fs/ocfs2/resize.c:308\nCode: 8b8520ff ffff83f8 860f8580 030000e8 5cc3c1fe\nCall Trace:\n...\nocfs2_ioctl+0x175/0x6e0 fs/ocfs2/ioctl.c:869\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:597 [inline]\n__se_sys_ioctl fs/ioctl.c:583 [inline]\n__x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\nx64_sys_call+0x1144/0x26a0 arch/x86/include/generated/asm/syscalls_64.h:17\ndo_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\ndo_syscall_64+0x93/0xf80 arch/x86/entry/syscall_64.c:94\nentry_SYSCALL_64_after_hwframe+0x76/0x7e\n...\n[CAUSE]\nocfs2_group_extend() assumes that the global bitmap inode block\nreturned from ocfs2_inode_lock() has already been validated and\nBUG_ONs when the signature is not a dinode. That assumption is too\nstrong for crafted filesystems because the JBD2-managed buffer path\ncan bypass structural validation and return an invalid dinode to the\nresize ioctl.\n[FIX]\nValidate the dinode explicitly in ocfs2_group_extend(). If the global\nbitmap buffer does not contain a valid dinode, report filesystem\ncorruption with ocfs2_error() and fail the resize operation instead of\ncrashing the kernel.", "A flaw was found in the OCFS2 (Oracle Cluster File System, version 2) component of the Linux kernel. A local attacker with control over a specially crafted filesystem could exploit a vulnerability in the `ocfs2_group_extend` function. This flaw arises from an insufficient validation of a global bitmap inode block, allowing a crafted filesystem to bypass structural validation. Successful exploitation leads to a kernel crash, resulting in a denial of service." ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 10",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:10"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:8"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  }, {
    "product_name" : "Red Hat Enterprise Linux 9",
    "fix_state" : "Not affected",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:9"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2026-31596\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31596\nhttps://lore.kernel.org/linux-cve-announce/2026042416-CVE-2026-31596-0201@gregkh/T" ],
  "name" : "CVE-2026-31596",
  "csaw" : false
}