CVE-2026-72163

A flaw was found in the Linux kernel's OCFS2 component. A local user with write access to an OCFS2 filesystem could trigger a kernel panic by performing a direct write over unwritten extents. This occurs when the journal aborts during Direct I/O (DIO) completion, leading to a NULL pointer dereference in the ocfs2_assure_trans_credits function. Successful exploitation results in a system crash, causing a Denial of Service (DoS).

A moderate impact flaw was found in the Linux kernel's OCFS2 file system. A local user with write access to an OCFS2 file system could cause a kernel panic (denial of service) by performing a direct write over unwritten extents: when the journal aborts during Direct I/O (DIO) completion, for example after an I/O error, the loop in ocfs2_dio_end_io_write() keeps using the aborted journal handle, and ocfs2_assure_trans_credits() reads the handle's remaining transaction credits without first checking whether the handle is aborted, dereferencing the cleared (NULL) transaction pointer and causing a general protection fault and system crash. All Red Hat Enterprise Linux and Red Hat In-Vehicle OS kernel streams listed in this flaw are not affected because the vulnerable code is not present in the shipped kernel versions, so no update is required for Red Hat products.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.