CVE-2026-72159
Description
A flaw was found in the OCFS2 file system within the Linux kernel. This vulnerability occurs when processing specially crafted file system metadata, specifically non-inline dinodes that report a non-zero file size but zero allocated clusters. An attacker could potentially create a malformed file system structure that, when processed, leads to repeated failures and system instability, resulting in a denial of service.
Statement
A moderate severity denial of service flaw was found in the Linux kernel's OCFS2 file system. When processing specially crafted file system metadata, specifically a non-inline dinode that reports a non-zero file size (i_size) while having zero allocated clusters (i_clusters), the kernel could repeatedly fail while advancing through the claimed size, for example when iterating a forged directory dinode with a huge i_size and no backing clusters, resulting in system instability and a denial of service. Exploiting this flaw requires local access to a system with a mounted OCFS2 file system and privileges sufficient to introduce malformed file system metadata (Red Hat CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel packages tracked for this flaw are not affected because the vulnerable code is not present in the shipped kernels.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.5 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
