EUVD-2026-67514
GHSA-pf3v-qrvc-chw5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Trigger requires local OCFS2 filesystem access and non-default refcount configuration, justifying AV:L and AC:H over the provided AV:N/AC:L; PR:L reflects required write access to the volume.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_remove_refcount_extent
[BUG] Unlinking a refcounted file whose refcount tree has leaf blocks triggers a fortify panic due to an out-of-bounds write.
[CAUSE] When the last leaf block is removed from a refcount tree, ocfs2_remove_refcount_extent() converts the root back to leaf mode with a bulk memset on &rb->rf_records. rf_records sits in an anonymous union with rf_list. rf_list.l_tree_depth aliases rf_records.rl_count, and is 0 for a single-level tree. With rl_count equal to 0, the memset writes past the 16-byte declared size of rf_records, which the fortify checker catches.
[FIX] Replace the bulk memset on &rb->rf_records with a correctly-bounded memset on rl_recs[] alone, after setting rl_count to the correct value.
AnalysisAI
Out-of-bounds write in the Linux kernel's OCFS2 cluster filesystem driver corrupts adjacent kernel memory when a low-privileged user unlinks a refcounted file whose refcount tree contains leaf blocks, triggering a fortify panic on hardened kernels. The root cause is an incorrect memset bound in ocfs2_remove_refcount_extent() arising from a union aliasing issue between rf_records.rl_count and rf_list.l_tree_depth. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires all of the following conditions to be simultaneously true: the target system must have the OCFS2 kernel module loaded and an OCFS2 filesystem actively mounted - this is non-default and absent on the vast majority of Linux systems; the attacker must hold write access (PR:L) to the OCFS2 volume to create and delete files; a file on that volume must be refcounted, meaning it was previously created via a reflink or clone operation; and the refcount tree for that file must contain at least one leaf block at the time of unlinking. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The provided CVSS score of 8.8 with AV:N/AC:L/PR:L significantly overstates the attack surface: the vulnerability is triggered by a local filesystem operation - unlinking a refcounted file on an OCFS2 volume - not a network-reachable code path, and requires OCFS2 to be actively mounted, which is a non-default configuration absent from most Linux deployments. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel version 7.1.5 or 7.2, which incorporate the fix replacing the unsafe bulk memset with a correctly-bounded memset on `rl_recs[]` after explicitly setting `rl_count`. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory systems running OCFS2 and identify which have multi-user local access or untrusted user populations. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today