Linux Kernel CVE-2026-90204

Requires the ocfs2 filesystem driver (CONFIG_OCFS2_FS) and a victim who mounts or processes an attacker-crafted ocfs2 disk image whose dinode carries an i_dio_orphaned_slot outside the mounted filesystem's slot range (the corrupted high byte at offset 0xa1). The use-after-free only fires during DIO orphan recovery (ocfs2_recover_orphans → ocfs2_del_inode_from_orphan), so an append-DIO orphaned inode must be present in the crafted image. Limiting factors: LOCAL vector only, mandatory user interaction (mounting untrusted media, typically requiring CAP_SYS_ADMIN), and the low deployment footprint of ocfs2 - no remote or network exposure exists.

This is a data-driven robustness fix in the ocfs2 cluster filesystem, not a remotely-triggerable memory-corruption primitive. The provided CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 7.8) correctly captures the LOCAL attack vector and required user interaction (UI:R) - the flaw is only reachable when a victim mounts and processes a corrupted on-disk ocfs2 image containing an out-of-range i_dio_orphaned_slot. The root cause is a slab-use-after-free: an unvalidated slot index from a crafted dinode is used to index the slot-local system inode cache, producing an invalid pointer that is later dereferenced as an inode during DIO orphan recovery (KASAN slab-use-after-free in ocfs2_get_system_file_inode via ocfs2_wipe_inode/ocfs2_recover_orphans). There is NO EPSS score, NO CISA KEV listing, and NO public POC in the provided data - exploitation status is 'no public exploit identified at time of analysis.' The vendor C:H/I:H/A:H triad is optimistic: the KASAN trace shows a bad-pointer READ dereferenced as an inode, which is crash-dominant (denial of service) rather than a controllable read/write primitive; confidentiality and integrity impact are not clearly established. Because triggering requires mounting attacker-supplied media (typically CAP_SYS_ADMIN) on the rarely-deployed ocfs2 filesystem, real-world risk is LOW-to-moderate despite the 7.8 base score - a genuine correctness fix but not an urgent, widely-exploitable priority.

An attacker crafts a malformed ocfs2 dinode (corrupting the high byte at offset 0xa1 from 0 to 1) so its i_dio_orphaned_slot falls outside the mounted filesystem's slot range, then delivers the image via removable media, a loopback file, or an automounted volume. When the victim mounts it and orphan recovery runs, ocfs2_del_inode_from_orphan indexes the slot-local system inode cache with the bad slot, dereferencing an invalid pointer as an inode and causing a slab-use-after-free kernel crash. No public exploit code is identified in the provided data, and the local vector plus mount-time user interaction (UI:R) sharply limit reach.