Skip to main content

Linux Kernel CVE-2026-63796

| EUVDEUVD-2026-45462 HIGH
Out-of-bounds Read (CWE-125)
2026-07-19 Linux GHSA-9923-9mc9-hq5v
Buffer Overflow Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.8 HIGH

Trigger needs a locally mounted malicious OCFS2 image (AV:L, PR:L for mount capability); a kernel UAF can leak memory and crash or corrupt, so C/I/A:H.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 15:30 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
8.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 12:02 cve.org
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject oversized group bitmap descriptors

ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap.

Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used.

Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_add_and_move+0x1f5/0x3d0 (?:?) ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemap_add_folio+0x105/0x1f0 (?:?) ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?) down_write+0xf5/0x180 (?:?) ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?) __mark_inode_dirty+0x758/0x9a0 (?:?) inode_to_bdi+0x41/0x90 (?:?) balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?) generic_perform_write+0x252/0x440 (?:?) mnt_put_write_access_file+0x16/0x70 (?:?) file_update_time_flags+0xe4/0x200 (?:?) ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lock_acquire+0x184/0x2f0 (?:?) ksys_write+0xd2/0x170 (?:?) apparmor_file_permission+0xf5/0x310 (?:?) read_zero+0x8d/0x140 (?:?) lock_is_held_type+0x8f/0x100 (?:?)

AnalysisAI

Out-of-bounds memory access in the Linux kernel's OCFS2 cluster filesystem allows a crafted on-disk group descriptor to trigger a use-after-free/OOB read during suballocator bitmap operations. The bug lives in ocfs2_validate_gd_parent(), which only checked bg_bits against the parent allocator's chain geometry and not against the bytes that physically fit in the group descriptor block, so a malicious bg_size/bg_bits pair drives later bitmap scans (ocfs2_find_max_contig_free_bits / ocfs2_block_group_set_bits) past bg_bitmap. It was found via KASAN and fixed upstream; no public exploit has been identified at time of analysis.

Technical ContextAI

OCFS2 is Oracle's shared-disk cluster filesystem shipped in the mainline Linux kernel (fs/ocfs2). It manages free space with chained group-descriptor blocks, each carrying a bitmap (bg_bitmap) whose size is bounded by the descriptor block. The validation routine ocfs2_validate_gd_parent() sanity-checks a group descriptor against its parent allocator inode but historically bounded bg_bits only by the allocator's chain geometry, not by the physical bitmap capacity returned by ocfs2_group_bitmap_size(). A descriptor claiming bg_size/bg_bits larger than the block can hold causes bit-scan helpers such as _find_next_bit() and ocfs2_find_max_contig_free_bits() to read/write beyond the allocated bitmap buffer. The root-cause class is out-of-bounds access / use-after-free (CWE-125 / CWE-416); the CVE record lists CWE as N/A. The fix adds a physical-cap check based on ocfs2_group_bitmap_size() while retaining the existing chain-geometry check, so both on-disk layout and allocator metadata must agree.

RemediationAI

Vendor-released patch: update to a fixed stable kernel for your series - 5.10.260, 5.15.211, 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1 (or your distribution's backport referencing CVE-2026-63796); the upstream fixes are the stable commits linked at git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6 and its siblings. Where immediate patching is not possible, the highest-value compensating control is to prevent mounting of untrusted OCFS2 images: unload or blacklist the ocfs2 module (modprobe -r ocfs2 / blacklist in modprobe.d) on hosts that do not need it, which eliminates the attack surface entirely at the cost of losing OCFS2 support. If OCFS2 is required, restrict who can mount filesystems by removing unprivileged/auto-mount paths for removable and network-attached devices (e.g. disable udisks/autofs automounting and enforce CAP_SYS_ADMIN-gated mounts), accepting the operational overhead of manual, vetted mounts. These controls do not fix the underlying OOB check, so patching remains the primary action.

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-63796 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy