CVE-2026-90204

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free error exists in the ocfs2 module of the Linux kernel. The issue occurs when a corrupted append-DIO dinode contains an i dio orphaned slot value that falls outside the mounted filesystem slot range. Because the dinode validator fails to check this active slot, the ocfs2 del inode from orphan() function uses the out-of-range value to index the slot-local system inode cache, resulting in an invalid cache entry pointer being dereferenced as an inode pointer. This flaw is triggered during the ocfs2 get system file inode() function call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.