CVE-2026-43075 (GCVE-0-2026-43075)
Vulnerability from cvelistv5
Published
2026-05-06 07:40
Modified
2026-08-05 12:25
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free write of 4086 bytes in ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on a loop device. The actual bug is an out-of-bounds write past the inode block buffer, not a true use-after-free. The write overflows into an adjacent freed page, which KASAN reports as UAF. The root cause is that ocfs2_try_to_write_inline_data trusts the on-disk id_count field to determine whether a write fits in inline data. On a corrupted filesystem, id_count can exceed the physical maximum inline data capacity, causing writes to overflow the inode block buffer. Call trace (crash path): vfs_copy_file_range (fs/read_write.c:1634) do_splice_direct splice_direct_to_actor iter_file_splice_write ocfs2_file_write_iter generic_perform_write ocfs2_write_end ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949) ocfs2_write_end_inline (fs/ocfs2/aops.c:1915) memcpy_from_folio <-- KASAN: write OOB So add id_count upper bound check in ocfs2_validate_inode_block() to alongside the existing i_size check to fix it.
References
Impacted products
Vendor Product Version
Linux Linux Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
Version: 1afc32b952335f665327a1a9001ba1b44bb76fd9
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "22df7d4de9c5cd42edf855a1de25f2106088c4c6",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "e2c9dc6b6e96f3585f2a1062ca3374a52db0938f",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "947f953978b0d9463498d548d0f054f5a75be2e9",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "0c1af902223b6fcedb60904ca0b551254686c7b9",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "69d3c69ade1e4285ab4ca48fe7acee0767e65604",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            },
            {
              "lessThan": "7bc5da4842bed3252d26e742213741a4d0ac1b14",
              "status": "affected",
              "version": "1afc32b952335f665327a1a9001ba1b44bb76fd9",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/inode.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.24"
            },
            {
              "lessThan": "2.6.24",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.24",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix out-of-bounds write in ocfs2_write_end_inline\n\nKASAN reports a use-after-free write of 4086 bytes in\nocfs2_write_end_inline, called from ocfs2_write_end_nolock during a\ncopy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on\na loop device.  The actual bug is an out-of-bounds write past the inode\nblock buffer, not a true use-after-free.  The write overflows into an\nadjacent freed page, which KASAN reports as UAF.\n\nThe root cause is that ocfs2_try_to_write_inline_data trusts the on-disk\nid_count field to determine whether a write fits in inline data.  On a\ncorrupted filesystem, id_count can exceed the physical maximum inline data\ncapacity, causing writes to overflow the inode block buffer.\n\nCall trace (crash path):\n\n   vfs_copy_file_range (fs/read_write.c:1634)\n     do_splice_direct\n       splice_direct_to_actor\n         iter_file_splice_write\n           ocfs2_file_write_iter\n             generic_perform_write\n               ocfs2_write_end\n                 ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)\n                   ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)\n                     memcpy_from_folio     \u003c-- KASAN: write OOB\n\nSo add id_count upper bound check in ocfs2_validate_inode_block() to\nalongside the existing i_size check to fix it."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable OCFS2 inline write path is reached through local VFS operations such as write/copy_file_range on an OCFS2 file, not by packets or physical device parsing directly.\nAC:L - Once a malformed inline-data inode with an excessive id_count is present, triggering the overflow is deterministic through ordinary writes and does not require winning a race or relying on conditions outside attacker control.\nPR:L - The write path itself has no OCFS2-specific privileged gate beyond normal file write permission, so a local user able to write the affected mounted file can trigger it. OCFS2 is not userns-mountable and crafting/mounting the corrupted image normally needs admin rights, but the highest reasonable shared-mounted-filesystem trigger requires only low local privileges.\nUI:N - After the affected OCFS2 filesystem is mounted, exploitation is triggered by the attacker\u0027s own file operation and does not require another user to act.\nS:U - The corruption occurs within kernel filesystem/buffer-cache memory and does not cross a separate security authority such as a guest/host or IOMMU boundary.\nC:H - This is attacker-controlled out-of-bounds kernel memory corruption, which can reasonably be leveraged into disclosure primitives rather than only a visible crash.\nI:H - The bug performs an out-of-bounds write from attacker-controlled file data past the inode block buffer, making high-integrity impact appropriate.\nA:H - The reported KASAN crash and the underlying kernel memory corruption can oops or panic the kernel, producing high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:25:46.787Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea"
        },
        {
          "url": "https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e"
        },
        {
          "url": "https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f"
        },
        {
          "url": "https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9"
        },
        {
          "url": "https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9"
        },
        {
          "url": "https://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604"
        },
        {
          "url": "https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14"
        }
      ],
      "title": "ocfs2: fix out-of-bounds write in ocfs2_write_end_inline",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-43075",
    "datePublished": "2026-05-06T07:40:03.337Z",
    "dateReserved": "2026-05-01T14:12:55.982Z",
    "dateUpdated": "2026-08-05T12:25:46.787Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.