High 7.8Published May 6, 2026

CVE-2026-43076ocfs2: validate inline data i_size during inode read

Updated under an hour ago (Oct 26, 2026, 3:50 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate inline data i_size during inode read When reading an inode from disk, ocfs2_validate_inode_block() performs various sanity checks but does not validate the size of inline data. If the filesystem is corrupted, an inode's i_size can exceed the actual inline data capacity (id_count). This causes ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer, triggering a use-after-free when accessing directory entries from freed memory. In the syzbot report: - i_size was 1099511627576 bytes (~1TB) - Actual inline data capacity (id_count) is typically <256 bytes - A garbage rec_len (54648) caused ctx->pos to jump out of bounds - This triggered a UAF in ocfs2_check_dir_entry() Fix by adding a validation check in ocfs2_validate_inode_block() to ensure inodes with inline data have i_size <= id_count. This catches the corruption early during inode read and prevents all downstream code from operating on invalid data.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 23193e513d1cd69411469f028d56fd175d4a6b07 before d012c782abcabe68b5b9e71be58a15e9f9d83dc1; from 23193e513d1cd69411469f028d56fd175d4a6b07 before bcd46bc261b215b3b12c557a978299eafa02ecdd; 23193e513d1cd69411469f028d56fd175d4a6b07 builds before 131c0b573e1b467b7d553e9ff38003f1acd8f5f2; 23193e513d1cd69411469f028d56fd175d4a6b07 builds before 37f074e65f24f10f8d8df224a572e4cb9e6faf63; from 23193e513d1cd69411469f028d56fd175d4a6b07 before c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b; from 23193e513d1cd69411469f028d56fd175d4a6b07 before cd2d765aa7157f852999842af32148128c735d39; 23193e513d1cd69411469f028d56fd175d4a6b07 builds before 77d0295725109d77f5854ef5b58c0d06c08168cc; 23193e513d1cd69411469f028d56fd175d4a6b07 builds before 1524af3685b35feac76662cc551cbc37bd14775f	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.24.1 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; 2.6.24; 7.0; 7.0; 7.0; and 4 more ranges	NVD

References

References

https://git.kernel.org/stable/c/d012c782abcabe68b5b9e71be58a15e9f9d83dc1
https://git.kernel.org/stable/c/bcd46bc261b215b3b12c557a978299eafa02ecdd
https://git.kernel.org/stable/c/131c0b573e1b467b7d553e9ff38003f1acd8f5f2
https://git.kernel.org/stable/c/37f074e65f24f10f8d8df224a572e4cb9e6faf63	patch
https://git.kernel.org/stable/c/c1de19e891be3bfb3e1d0c7cf07bbb8fb3b77c1b	patch
https://git.kernel.org/stable/c/cd2d765aa7157f852999842af32148128c735d39	patch
https://git.kernel.org/stable/c/77d0295725109d77f5854ef5b58c0d06c08168cc	patch
https://git.kernel.org/stable/c/1524af3685b35feac76662cc551cbc37bd14775f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.