Skip to content
Heist/ feed
Back to feed
HighFix available

ocfs2: validate inline data i_size during inode read

Type: advisorySources: OSV

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data. If the filesystem is corrupted, an inode's i_size can exceed the actual inline data capacity (id_count). This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer, triggering a use-after-free when accessing directory entries from freed memory. In the syzbot report: - i_size was 1099511627576 bytes (~1TB) - Actual inline data capacity (id_count) is typically <256 bytes - A garbage rec_len (54648) caused ctx->pos to jump out of bounds - This triggered a UAF in ocfs2_check_dir_entry() Fix by adding a validation check in ocfs2_validate_inode_block() to ensure inodes with inline data have i_size <= id_count. This catches the corruption early during inode read and prevents all downstream code from operating on invalid data.

Products
Kernel
Affected versions
Not specified
Fixed versions
5.10.258, 5.15.209, 6.1.175, 6.12.83, 6.18.24, 6.19.14, 6.6.136
CVEs
CVE-2026-43076
Confirmed fixed CVEs
Not specified
Updated in this feed
8 Nov 2026, 00:46 UTC · Revision 1

Source evidence

ocfs2: validate inline data i_size during inode read

core-osv · Original source

Published 6 May 2026, 07:40 UTC

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data. If the filesystem is corrupted, an inode's i_size can exceed the actual inline data capacity (id_count). This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer, triggering a use-after-free when accessing directory entries from freed memory. In the syzbot report: - i_size was 1099511627576 bytes (~1TB) - Actual inline data capacity (id_count) is typically <256 bytes - A garbage rec_len (54648) caused ctx->pos to jump out of bounds - This triggered a UAF in ocfs2_check_dir_entry() Fix by adding a validation check in ocfs2_validate_inode_block() to ensure inodes with inline data have i_size <= id_count. This catches the corruption early during inode read and prevents all downstream code from operating on invalid data.

osv:CVE-2026-43076

Kernel

Fixed versions: 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.83, 6.18.24, 6.19.14

Complete source record
{
  "id": "23126d00d7a82d5da0635802633042514ee426e159d314e6ca4e4a4b303c045e",
  "url": "https://osv.dev/vulnerability/CVE-2026-43076",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ocfs2: validate inline data i_size during inode read",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data. If the filesystem is corrupted, an inode's i_size can exceed the actual inline data capacity (id_count). This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer, triggering a use-after-free when accessing directory entries from freed memory. In the syzbot report: - i_size was 1099511627576 bytes (~1TB) - Actual inline data capacity (id_count) is typically <256 bytes - A garbage rec_len (54648) caused ctx->pos to jump out of bounds - This triggered a UAF in ocfs2_check_dir_entry() Fix by adding a validation check in ocfs2_validate_inode_block() to ensure inodes with inline data have i_size <= id_count. This catches the corruption early during inode read and prevents all downstream code from operating on invalid data.",
    "evidence": "osv:CVE-2026-43076",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.258",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.209",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.175",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.136",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.83",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.24",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.19.14",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "high",
    "structured": {
      "id": "CVE-2026-43076",
      "aliases": [
        "CVE-2026-43076"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "23193e513d1cd69411469f028d56fd175d4a6b07"
                },
                {
                  "fixed": "d012c782abcabe68b5b9e71be58a15e9f9d83dc1"
                },
                {
                  "fixed": "bcd46bc261b215b3b12c557a978299eafa02ecdd"
                },
                {
                  "fixed": "131c0b573e1b467b7d553e9ff38003f1acd8f5f2"
                },
                {
                  "fixed": "37f074e65f24f10f8d8df224a572e4cb9e6faf63"
                },
                {
                  "fixed": "c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b"
                },
                {
                  "fixed": "cd2d765aa7157f852999842af32148128c735d39"
                },
                {
                  "fixed": "77d0295725109d77f5854ef5b58c0d06c08168cc"
                },
                {
                  "fixed": "1524af3685b35feac76662cc551cbc37bd14775f"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43076.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.24"
                },
                {
                  "fixed": "5.10.258"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.209"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.175"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.136"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.83"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.24"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "6.19.14"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-43076.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:52.354505146Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2",
        "https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f",
        "https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63",
        "https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc",
        "https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd",
        "https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b",
        "https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39",
        "https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43076.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-43076",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/43xxx/CVE-2026-43076.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-43076",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 521081,
  "published_at": "2026-05-06T07:40:13.634+00:00"
}