Skip to main content

Linux Kernel CVE-2026-72162

| EUVDEUVD-2026-58920 HIGH
2026-08-15 416baaa9-dc9f-4396-8d5f-8c081fb06d67 GHSA-w4g7-33m6-26g5
Buffer Overflow Linux Red Hat Suse
7.8
CVSS 3.1 · Vendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Share

Severity by source

Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

On-disk corruption prerequisite elevates effective attack complexity to AC:H; local access and low privileges are confirmed by the exploitation path.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (416baaa9-dc9f-4396-8d5f-8c081fb06d67).

CVSS VectorVendor: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 07:21 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.8 (HIGH)
Patch available
Aug 15, 2026 - 07:20 EUVD
CVE Published
Aug 15, 2026 - 06:21 cve.org
HIGH 7.8
CVE Published
Aug 15, 2026 - 06:21 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file.

[CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.

[FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.

AnalysisAI

Unbounded array indexing in the ocfs2 filesystem's ocfs2_sum_rightmost_rec() function causes UBSAN-detected kernel panic or memory corruption when a file write targets an inode whose embedded extent list has been corrupted on-disk. Linux kernels prior to 6.18.40 (stable 6.x branch) and 7.1.5 (7.x branch) are affected on any system mounting an ocfs2 volume. No public exploit has been identified at time of analysis and EPSS probability sits at 0.21% (11th percentile), reflecting realistically constrained exploitability due to the required on-disk corruption precondition.

Technical ContextAI

ocfs2 (Oracle Cluster File System 2) is a shared-disk cluster filesystem built into the Linux kernel, commonly deployed in Oracle RAC environments. The vulnerable function ocfs2_sum_rightmost_rec() computes the array index i = le16_to_cpu(el->l_next_free_rec) - 1 and directly accesses el->l_recs[i] without first validating i. The l_recs[] array carries a __counted_by_le(l_count) annotation, which instructs UBSAN to enforce that all accesses remain within the declared bounds. When on-disk corruption sets l_next_free_rec to 0, integer arithmetic produces i = -1; when l_next_free_rec exceeds l_count, i overruns the end of the array. Both cases trigger a UBSAN array-index-out-of-bounds panic on the next write operation against the affected file. Although tagged 'Buffer Overflow' in the intelligence metadata, the root cause is more precisely an absent array-index validation (analogous to CWE-129), corrected in the patch by adding explicit sanity checks for both l_count and l_next_free_rec inside ocfs2_validate_inode_block() at inode read time, rejecting corrupt metadata before any b-tree traversal can dereference l_recs[].

RemediationAI

The definitive fix is to upgrade to Linux kernel 6.18.40 or later on the 6.x stable branch, or to 7.1.5 or later on the 7.x branch; distributions such as RHEL, Oracle Linux, SUSE, and Ubuntu should be consulted for their backported package versions. The upstream patch commits can be reviewed at https://git.kernel.org/stable/c/858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85, https://git.kernel.org/stable/c/452a8467be8143747292218212671deeb186d2ae, and https://git.kernel.org/stable/c/671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1. Where immediate upgrade is not possible, disabling or not loading the ocfs2 kernel module on systems that do not require cluster filesystem functionality eliminates the attack surface entirely with no operational trade-off for non-ocfs2 workloads. For systems that must continue using ocfs2, running fsck.ocfs2 regularly to detect and repair inode corruption reduces the likelihood of a corrupt l_next_free_rec persisting undetected, though this is a detection and recovery control, not a prevention control. Restricting local user access to systems mounting ocfs2 volumes further limits the set of principals who could trigger the panic.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-72162 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy