CVE-2026-72159

A flaw was found in the OCFS2 file system within the Linux kernel. This vulnerability occurs when processing specially crafted file system metadata, specifically non-inline dinodes that report a non-zero file size but zero allocated clusters. An attacker could potentially create a malformed file system structure that, when processed, leads to repeated failures and system instability, resulting in a denial of service.

A moderate severity denial of service flaw was found in the Linux kernel's OCFS2 file system. When processing specially crafted file system metadata, specifically a non-inline dinode that reports a non-zero file size (i_size) while having zero allocated clusters (i_clusters), the kernel could repeatedly fail while advancing through the claimed size, for example when iterating a forged directory dinode with a huge i_size and no backing clusters, resulting in system instability and a denial of service. Exploiting this flaw requires local access to a system with a mounted OCFS2 file system and privileges sufficient to introduce malformed file system metadata (Red Hat CVSS 5.5, AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H). The Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel packages tracked for this flaw are not affected because the vulnerable code is not present in the shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.