Look up another CVE · open CVE-2026-90204 in the interactive tracker
CVE-2026-90204
ocfs2: validate DIO orphan slot during inode read
Published 2026-09-17 (31 days ago) by the Linux kernel CNA. Subsystem fs/ocfs2. Debian urgency: not yet assigned.
What to do, per Debian release
Debian's own status for CVE-2026-90204 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | vulnerable | 6.1.190-1 | No fix published anywhere yet, neither in Debian nor upstream for the series bookworm tracks. Watch the Debian tracker page for this CVE. Advisories for bookworm have historically landed a median of 23 days after publication. |
| Debian 13trixie | vulnerable | 6.12.113-1 | No fix published anywhere yet, neither in Debian nor upstream for the series trixie tracks. Watch the Debian tracker page for this CVE. Advisories for trixie have historically landed a median of 11 days after publication. |
| Debian 14forky | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.2.6-1 | Update the kernel and reboot. Fixed in 7.2.6-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
[BUG] A corrupted append-DIO dinode (high byte at offset 0xa1 corrupted from 0 to 1) can carry an i_dio_orphaned_slot outside the mounted filesystem slot range and trigger a use-after-free error: BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline] ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ... [CAUSE] ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the slot-local system inode cache. The dinode validator does not check this active slot, so an out-of-range value produces an invalid cache entry pointer that is dereferenced as an inode pointer. [FIX] Reject an active i_dio_orphaned_slot outside the slot range during dinode validation, before DIO orphan recovery can consume it.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
fs/ocfs2/inode.c
- What this is
- ORACLE CLUSTER FILESYSTEM 2 (OCFS2)MAINTAINERS section matched on fs/ocfs2/ · ocfs2-devel@lists.linux.dev · Supported
- Kernel module
- ocfs2
Check it on the machine
grep -w CONFIG_OCFS2_FS /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
lsmod | grep -w ocfs2Prints a line if that module is loaded right now, and nothing if it is not. One that is not loaded can still be loaded later by anything that needs it.
Show whether Debian builds this, per release
Debian builds this, but not on every flavour. At least one release below builds the code on some of its kernel flavours and not on others, so the answer depends on the architecture and flavour installed.
- bookworm, trixie, forky, sidMnot built on amd64/cloud-amd64, arm64/cloud-arm64
- M
- a module where it is built at all; some flavours do not build it
- Build switch
- CONFIG_OCFS2_FS
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-09-17 (31 days ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.18%, higher than 7.0% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- not yet assignedsource
- Subsystem
- fs/ocfs2
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 4.0 | 6.18.52 | e35fa6eb4d2a |
| 4.0 | 7.2.6 | 418e0ae42fa7 |
| 4.0 | 7.3 | bb88131c9831 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The bad i_dio_orphaned_slot is an on-disk ocfs2_dinode field (offset 0xa0) consumed by ocfs2_del_inode_from_orphan() after ocfs2_validate_inode_block() along ocfs2_fill_super→ocfs2_complete_mount_recovery→ocfs2_recover_orphans (or ocfs2_add_inode_to_orphan on append DIO). No network protocol carries this slot.
- AC:LAttack complexity, low
- A dinode with OCFS2_DIO_ORPHANED_FL and i_dio_orphaned_slot >= osb->max_slots (the reported 0xa1 0→1 flip yields slot 256) makes get_local_system_inode() index slot*NUM_LOCAL_SYSTEM_INODES past the kzalloc(max_slots*NUM_LOCAL_SYSTEM_INODES) cache and igrab the out-of-range pointer with no race.
- PR:NPrivileges required, none
- ocfs2_fs_type lacks FS_USERNS_MOUNT, so mount_capable() requires init-namespace CAP_SYS_ADMIN. The higher-severity case is a crafted loop/LUN image whose recovery runs when an administrator mounts it, so the attacker needs no account or capability on the victim.
- UI:RUser interaction, required
- The attacker-supplied ocfs2 image must be mounted via ocfs2_fill_super so ocfs2_complete_mount_recovery() can walk DIO orphan dirents and call ocfs2_del_inode_from_orphan() on the forged i_dio_orphaned_slot. That mount is the required victim action.
- S:UScope, unchanged
- igrab() of the out-of-range local_system_inodes[] pointer and later ocfs2_inode_lock() stay inside the kernel that mounted the volume; this is not a KVM/Xen guest-to-host escape or IOMMU/DMA bypass.
- C:HConfidentiality impact, high
- get_local_system_inode() reads an 8-byte inode pointer past the slot-local cache, then igrab() and ocfs2_inode_lock() treat it as a live inode. KASAN reported slab-use-after-free in ocfs2_get_system_file_inode(); a UAF inode object yields an arbitrary kernel read.
- I:HIntegrity impact, high
- After igrab() on the OOB/UAF pointer, ocfs2_del_inode_from_orphan() takes inode_lock and ocfs2_inode_lock on that object and journals orphan-dir mutations through it, which is a type-confused write/control-flow primitive on a freed or adjacent heap object.
- A:HAvailability impact, high
- igrab() on a garbage or I_FREEING pointer hits BUG_ON(!inode) in ocfs2_get_system_file_inode() or the KASAN UAF oops shown on the ocfs2_recover_orphans mount-recovery path, which is a kernel crash.