Linux Kernel CVE-2026-72164

The vulnerability is in the OCFS2 (Oracle Cluster File System 2) subsystem of the Linux kernel, specifically the interaction between ocfs2_move_extent() and its helper ocfs2_probe_alloc_group(). In non-auto mode, the OCFS2_IOC_MOVE_EXT ioctl accepts a userspace-supplied physical goal cluster (me_goal); the probe is then expected to scan the target block group for a sufficiently large free run and write the actual free cluster start into *phys_cpos. Two distinct logic errors exist: first, *phys_cpos is never zeroed before the scan begins, so if the probe exhausts the group without finding a free run, the caller-supplied goal - which may reference an occupied cluster - remains as the output. Second, the free-run start calculation subtracts move_len from the ending bit index rather than move_len minus one, yielding an off-by-one that reports the bit immediately preceding the actual free run. The combined effect is that __ocfs2_move_extent() can receive an occupied cluster address, then copy file data into it before the allocation bitmap is updated, violating the exclusivity invariant of the allocator. CWE is listed as N/A by NVD, but the root cause class is best described as CWE-665 (Improper Initialization) compounded by CWE-682 (Incorrect Calculation) in the block group probe path.