Linux Kernel EUVD-2026-81798

Requires the OCFS2 filesystem driver (fs/ocfs2) and that the victim mount and process an attacker-crafted or corrupted OCFS2 image whose dinode has OCFS2_ORPHANED_FL set with an i_orphaned_slot value outside osb->max_slots; the OOB access is reached specifically through inode wipe / orphan recovery (ocfs2_wipe_inode -> ocfs2_get_system_file_inode) during inode eviction. Limiting factors: local attack vector (no remote reach), required user interaction (UI:R - a victim must mount the malicious image), and the fact that mounting an arbitrary filesystem image normally requires CAP_SYS_ADMIN, which substantially narrows realistic exploitation to scenarios involving automatic mounting of untrusted removable media or images. Affects kernels from 2.6.16 up to the fix; patched in 6.18.52, 7.2.6, and 7.3-rc1.

This is a genuine memory-safety defect but not a high-priority exploitation target. The vendor CVSS is 7.8 (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), yet the vector itself signals limited reach: AV:L means no remote access, and UI:R means a victim must mount and process a maliciously crafted OCFS2 filesystem image (mounting a filesystem typically requires CAP_SYS_ADMIN, further gating the trigger). No EPSS score, no CISA KEV listing, and no public exploit code are present in the input, so there is no evidence of active exploitation or automatable weaponization. The technical root cause - ocfs2_validate_inode_block() validates i_suballoc_slot but leaves the active ordinary orphan slot (i_orphaned_slot) unchecked, allowing an out-of-range value to index osb_orphan_wipes and the slot-local system-inode cache - produces an out-of-bounds access whose observed manifestation (KASAN slab-use-after-free read during orphan recovery / inode eviction) is a crash. The vendor-rated C:H/I:H/A:H is optimistic: the demonstrated primitive is an OOB/UAF read on a teardown path, which realistically yields denial-of-service with, at most, contingent information disclosure - full integrity impact is not established by the description. Conflict to flag: CWE is 'N/A' in the input and the 'Buffer Overflow' tag describes an OOB array-index / read condition (closer to CWE-129/CWE-125) rather than a classic write overflow.

An attacker crafts a malicious OCFS2 disk image (or corrupts an existing one) in which a dinode carries OCFS2_ORPHANED_FL together with an i_orphaned_slot value outside the mounted filesystem's slot range. When a victim mounts the image and the kernel later processes that inode during orphan wipe/recovery, ocfs2_wipe_inode() uses the unvalidated slot to index osb_orphan_wipes and the system-inode cache out of bounds, causing a KASAN-detected slab-use-after-free and a kernel crash. No public proof-of-concept is identified in the provided data.