CVE-2026-72160

A flaw was found in ocfs2 (Oracle Cluster File System version 2) in the Linux kernel. This vulnerability arises from insufficient validation of on-disk inode metadata, specifically the i_mode type bits. A local attacker could exploit this by crafting a malformed disk inode with a non-canonical POSIX file type. This could bypass existing validation checks, potentially leading to unexpected system behavior or instability when the kernel processes the malformed inode.

A moderate severity flaw was found in the Linux kernel's OCFS2 file system. The ocfs2_validate_inode_block() function accepted on-disk dinodes whose i_mode type bits did not name one of the seven canonical POSIX file types, and ocfs2_populate_inode() copied such a mode verbatim into the in-core inode, where an unrecognized type fell through to the special-file inode operations. A local attacker able to supply a crafted OCFS2 file system image, which requires local access and privileges sufficient to present such metadata, could use a malformed inode to bypass existing validation, causing unexpected system behavior or instability and a denial of service. Red Hat rated this flaw CVSS 3.1 5.5 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) because exploitation requires local access and the impact is limited to system availability; this is lower than the upstream CVE record severity of 8.8, which assumes a network attack vector that the technical evidence does not support. All currently assessed Red Hat product streams (Red Hat Enterprise Linux 6 through 10, including kernel-rt, and Red Hat In-Vehicle OS) are recorded as not affected because the vulnerable code is not present in those shipped kernels.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.