Linux Kernel CVE-2026-72160

Exploitation requires that the target system mounts an OCFS2 filesystem - the vulnerability does not exist in kernels that only use other filesystem types. An attacker must have the ability to write a malformed dinode to the underlying OCFS2 block device, which in practice means either: privileged raw block-device write access on a cluster node, root-equivalent shell access with dd or similar tools, or compromise of a peer cluster node that shares the same storage volume. The victim kernel must then read the forged dinode via the normal OCFS2 I/O path (including online filecheck). The vulnerability does not affect the on-disk filesystem structure itself - it is triggered only at read time when the kernel processes the malformed metadata. Non-OCFS2 systems, systems where OCFS2 is installed but not mounted, and kernels running patched versions are not affected.

The assigned CVSS of 8.8 (AV:N/AC:L/PR:L) is in meaningful tension with the described attack surface. To place a malformed dinode on an OCFS2 filesystem requires either raw block-device write access, a privileged shell with filesystem-level capabilities, or compromise of a cluster peer node - none of which maps cleanly to AV:N/PR:L for an external attacker. The network vector is most plausible in the cluster context, where a compromised node writes malformed metadata to shared storage that is then consumed by other nodes, but this still presupposes high-privilege control of the initial node. EPSS at 0.22% (13th percentile) independently signals low exploitation probability, consistent with the complexity of pre-positioning forged filesystem metadata. There is no CISA KEV listing and no public exploit code identified at time of analysis. Despite these moderating factors, the kernel-level C:H/I:H/A:H impact means that any successful exploitation could yield full memory read, arbitrary kernel writes, or a total system crash - so even a mid-sized municipal IT team in tczew running OCFS2 cluster storage should treat outstanding kernel patching as a genuine priority rather than deferring to the low EPSS alone. The CVSS vector's PR:L claim should be verified with the kernel security team; based on the description, PR:H or at minimum PR:L with specific storage-layer access is a more accurate characterization.

An attacker with privileged write access to a shared OCFS2 block device - for example, a compromised cluster node or a rogue storage administrator - crafts a dinode containing an i_mode value whose S_IFMT type bits do not match any canonical POSIX file type and writes it to the raw device. When any cluster node subsequently reads that inode through the normal OCFS2 read path, the unvalidated i_mode is copied into the in-core inode and dispatched to init_special_inode() with an unexpected argument, potentially corrupting kernel memory structures or leaking kernel heap content. No public proof-of-concept exploit code has been identified at time of analysis.