Linux Kernel EUVD-2026-59497

Exploitation requires that the system mount an attacker-crafted or corrupted ocfs2 filesystem containing a zero-cluster (fast) symlink dinode whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size, and then that a fast symlink on that volume be read (e.g. via readlink/VFS page_get_link). Limiting factors: the ocfs2 module must be present/loaded, the target must actually mount the malicious volume (normally requiring mount privileges/CAP_SYS_ADMIN or an automount configuration), and the payload is triggered on the fast-symlink read path - this is not remotely reachable over a network despite the feed's AV:N rating.

The feed's CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates real-world risk and conflicts with the description: this is not a network-reachable, unauthenticated RCE - it is a local, on-disk-metadata bug that requires mounting a crafted or corrupted ocfs2 image, so the true attack vector is Local and privileges to mount are typically needed. The impact is memory disclosure (a kernel over-read, consistent with the 'Information Disclosure' tag), not integrity or code execution, making C:H/I:H/A:H an overestimate - a kernel-memory leak plus possible crash is the realistic outcome. Corroborating low-urgency signals: EPSS 0.15% (5th percentile), no CISA KEV listing, and no public exploit - only a KASAN reproducer typical of fuzzing. Verify the vector with the vendor: CVSS says network but the description clearly implies local access via a malicious filesystem. Net priority is low-to-moderate; the population that should act quickly is the subset actually running ocfs2 (clustered/Oracle-style storage), and for those operators mounting untrusted or attacker-supplied volumes it is a genuine defense-in-depth patch rather than an emergency.

An attacker who can present a filesystem image to a target - e.g. a crafted ocfs2 volume on a USB device, loopback image, or attacker-controlled shared LUN - mounts it (or induces automount) and issues a readlink() on a fast symlink whose dinode has a bogus i_size or missing NUL. The read path over-copies past the inode block buffer, leaking adjacent kernel memory back through readlink or crashing the kernel. Only a KASAN reproducer is known; no weaponized public exploit is identified.