CVE-2026-72160

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the OCFS2 file system where the ocfs2 validate inode block() function accepts any non-zero i mode value. This allows malformed on-disk fields to be copied into the in-core inode via ocfs2 populate inode(). Specifically, the system fails to reject dinodes with non-canonical POSIX file types, non-device dinodes with a non-zero id1.dev1.i rdev field, and non-inline dinodes that claim a non-zero i size while i clusters is zero. To address this, structural checks were added to ensure that i mode values match canonical POSIX file types using the fs umode to ftype() helper, and that other on-disk fields are validated before being processed by ocfs2 populate inode() or the online filecheck path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.