CVE-2026-72160

Status: UPDATED  |  Advisory ID: CVE-2026-72160

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject dinodes with non-canonical i_mode type

Patch series "ocfs2: harden inode validators against forged metadata", v2.

This series adds three structural checks to OCFS2 dinode validation so

malformed on-disk fields are rejected before ocfs2_populate_inode() copies

them into the in-core inode.

The checks cover:

- i_mode values whose type bits do not name a canonical POSIX file

type;

- non-device dinodes whose id1.dev1.i_rdev field is non-zero; and

- non-inline dinodes that claim non-zero i_size while i_clusters is

zero, covering directories unconditionally and regular files on

non-sparse volumes.

The normal read path reports these through ocfs2_error(), matching the

existing suballoc-slot, inline-data, chain-list, and refcount checks. The

online filecheck path uses the same structural predicates but keeps its

own reporting contract, returning OCFS2_FILECHECK_ERR_INVALIDINO instead

of calling ocfs2_error().

This patch (of 3):

ocfs2_validate_inode_block() currently accepts any non-zero i_mode value.

ocfs2_populate_inode() then copies that mode verbatim into inode->i_mode

and dispatches on i_mode & S_IFMT to the file/dir/symlink/special_file

iops; an unrecognised type falls through to ocfs2_special_file_iops and

init_special_inode().

Reject dinodes whose type bits do not name one of the seven canonical

POSIX file types. Use fs_umode_to_ftype(), the same generic file-type

conversion helper OCFS2 already uses for directory entries, so the

accepted inode type set matches the kernel file-type vocabulary instead of

open-coding a local switch.

Apply the same structural check to the online filecheck read path.

filecheck keeps its own error namespace, so it reports malformed i_mode

through the filecheck logger and OCFS2_FILECHECK_ERR_INVALIDINO instead of

calling ocfs2_error(), but it must not allow a malformed dinode to proceed

into ocfs2_populate_inode(). (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References