CVE-2026-72162

A flaw was found in ocfs2, a component of the Linux kernel. On-disk corruption of an inode's embedded extent list can lead to an array-index-out-of-bounds error. This occurs when the l_next_free_rec value is zero or exceeds l_count during a write operation to the affected file. A local attacker with the ability to corrupt the disk could trigger a kernel panic, leading to a denial of service.

This vulnerability is rated as having a Moderate impact because exploiting it requires an attacker to provide and mount a specially crafted, corrupted file system image, which limits the blast radius to a local denial of service. Standard Red Hat Enterprise Linux configurations restrict file system mounting operations to privileged users with root access or administrative capabilities, significantly constraining unprivileged exposure. Furthermore, the Oracle Cluster File System 2 (OCFS2) is not widely deployed by default across standard installations, substantially reducing the practical attack surface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.