CVE-2026-43075 Overview
CVE-2026-43075 is an out-of-bounds write vulnerability in the Linux kernel's Oracle Cluster File System version 2 (OCFS2) implementation. The flaw resides in the ocfs2_write_end_inline function within fs/ocfs2/aops.c. When a corrupted OCFS2 filesystem is mounted, the kernel trusts the on-disk id_count field without validating it against the physical maximum inline data capacity. This allows a write to overflow the inode block buffer by up to 4086 bytes into adjacent memory pages. KASAN reports the condition as a use-after-free write, though the underlying defect is a buffer boundary violation triggered through the copy_file_range splice fallback path.
Critical Impact
A local attacker who can mount a maliciously crafted OCFS2 filesystem image can corrupt adjacent kernel memory, leading to kernel memory corruption and potential privilege escalation.
Affected Products
- Linux kernel versions containing the OCFS2 filesystem driver prior to the patched commits
- Distributions shipping vulnerable Linux kernels with OCFS2 support enabled
- Systems permitting non-privileged mounts of OCFS2 images via loop devices
Discovery Timeline
- 2026-05-06 - CVE-2026-43075 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43075
Vulnerability Analysis
The vulnerability arises in OCFS2's inline data write handling. When a write operation targets a file using inline data storage, ocfs2_try_to_write_inline_data reads the id_count field from the on-disk inode to determine remaining capacity. The function does not bound-check this attacker-controlled value against the actual size of the inline data area within the inode block.
On a corrupted filesystem, id_count can be set to a value larger than the physical inline storage region. When ocfs2_write_end_inline subsequently calls memcpy_from_folio, the copy proceeds past the end of the inode block buffer. The overflow extends into an adjacent freed page, which KASAN flags as a use-after-free write of up to 4086 bytes.
The crash path traverses vfs_copy_file_range → do_splice_direct → splice_direct_to_actor → iter_file_splice_write → ocfs2_file_write_iter → generic_perform_write → ocfs2_write_end → ocfs2_write_end_nolock → ocfs2_write_end_inline.
Root Cause
The root cause is missing input validation in ocfs2_validate_inode_block(). The validator already checks i_size but never enforces an upper bound on id_count. Trusting this on-disk metadata field on a mounted but corrupted filesystem permits the inline-write fast path to exceed the physical inline buffer capacity.
Attack Vector
An attacker requires the ability to mount a crafted OCFS2 filesystem image, typically via a loop device. After mounting, performing a copy_file_range operation that triggers the splice fallback against an inline-data file with a poisoned id_count value induces the out-of-bounds write. Successful exploitation depends on the layout of adjacent kernel pages at the time of overflow.
No verified public exploit code is available. See the upstream patches for the technical fix details: Kernel Git Commit 947f9539 and Kernel Git Commit 7bc5da48.
Detection Methods for CVE-2026-43075
Indicators of Compromise
- KASAN kernel log entries reporting use-after-free writes inside ocfs2_write_end_inline or memcpy_from_folio called from OCFS2 code paths.
- Kernel oops or panic stack traces containing the sequence ocfs2_file_write_iter → ocfs2_write_end_nolock → ocfs2_write_end_inline.
- Unexpected mounts of OCFS2 filesystems backed by loop devices on hosts that do not normally use clustered storage.
Detection Strategies
- Monitor dmesg and /var/log/kern.log for KASAN reports and OCFS2 corruption warnings emitted by ocfs2_validate_inode_block().
- Audit mount and losetup syscall telemetry to identify untrusted users mounting filesystem images.
- Track loading of the ocfs2 kernel module on systems that should not require clustered filesystem support.
Monitoring Recommendations
- Forward kernel logs to a centralized SIEM and alert on KASAN signatures referencing OCFS2 functions.
- Inventory installed kernel versions across the fleet and flag hosts running unpatched releases identified in the upstream stable trees.
- Watch for repeated process crashes or kernel taints originating from filesystem-related syscalls invoked by non-root users.
How to Mitigate CVE-2026-43075
Immediate Actions Required
- Update affected Linux systems to a kernel release that includes the upstream OCFS2 fixes referenced below.
- Restrict CAP_SYS_ADMIN and the ability of non-administrative users to mount filesystem images, particularly via loop devices.
- Disable the ocfs2 kernel module on hosts that do not require clustered filesystem functionality.
Patch Information
The upstream fix adds an id_count upper-bound check to ocfs2_validate_inode_block() so that corrupted on-disk inodes are rejected before reaching the inline-write path. The fix is distributed across the following stable commits: 0c1af902, 69d3c69a, 7bc5da48, 947f9539, and e2c9dc6b. Apply the vendor-provided kernel update for your distribution.
Workarounds
- Blacklist the ocfs2 module via /etc/modprobe.d/ on systems that do not use OCFS2.
- Configure udev and polkit rules to prevent unprivileged users from invoking mount against arbitrary block or loop devices.
- Mount any necessary OCFS2 volumes only from trusted sources and verify image integrity before use.
# Disable the OCFS2 module on systems that do not need it
echo 'install ocfs2 /bin/true' | sudo tee /etc/modprobe.d/disable-ocfs2.conf
sudo rmmod ocfs2 2>/dev/null || true
# Verify the running kernel version against the patched stable release
uname -r
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
