CVE-2026-90204

Status: UPDATED  |  Advisory ID: CVE-2026-90204

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate DIO orphan slot during inode read

[BUG]

A corrupted append-DIO dinode (high byte at offset 0xa1

corrupted from 0 to 1) can carry an i_dio_orphaned_slot

outside the mounted filesystem slot range and trigger a

use-after-free error:

BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102

Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85

Call Trace:

...

ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102

ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840

ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]

ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295

evict+0x38e/0x8f0 fs/inode.c:810

iput_final fs/inode.c:1914 [inline]

iput fs/inode.c:1966 [inline]

iput+0x55b/0x8b0 fs/inode.c:1926

ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374

ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373

...

[CAUSE]

ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the

slot-local system inode cache. The dinode validator does not check

this active slot, so an out-of-range value produces an invalid cache

entry pointer that is dereferenced as an inode pointer.

[FIX]

Reject an active i_dio_orphaned_slot outside the slot range during

dinode validation, before DIO orphan recovery can consume it. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References