CVE-2026-53040

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A crafted filesystem can trigger an out-of-bounds bitmap walk in the Linux kernel. This occurs when OCFS2 IOC INFO is issued with OCFS2 INFO FL NON COHERENT. The issue stems from the ocfs2 info freefrag scan chain() function using on-disk bg bits directly as the bitmap scan limit. While the coherent path validates group descriptors via ocfs2 read group descriptor(), the non-coherent path uses ocfs2 read blocks sync() and skips this validation. Consequently, an invalid bg bits value can cause the bitmap walk to exceed the block boundary, leading to a use-after-free condition. This affects the following functions: ocfs2 info freefrag scan chain(), ocfs2 info freefrag scan bitmap(), ocfs2 info handle freefrag(), and ocfs2 info handle request().

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.