CVE-2026-43076: Linux Kernel Use-After-Free Vulnerability

CVE-2026-43076 Overview

CVE-2026-43076 is a Linux kernel vulnerability in the Oracle Cluster File System version 2 (ocfs2) implementation. The flaw resides in ocfs2_validate_inode_block(), which fails to validate the size of inline data when reading an inode from disk. A corrupted filesystem can present an inode whose i_size exceeds the actual inline data capacity (id_count), causing ocfs2_dir_foreach_blk_id() to iterate beyond the inline data buffer. The out-of-bounds traversal triggers a use-after-free in ocfs2_check_dir_entry() when accessing directory entries from freed memory. The issue was discovered through syzbot fuzzing and resolved upstream by adding an explicit i_size <= id_count check during inode read.

Critical Impact
An attacker who can mount a maliciously crafted ocfs2 filesystem image can trigger a use-after-free in the Linux kernel, leading to memory corruption and potential denial of service or privilege escalation.

Affected Products

Linux kernel versions implementing the ocfs2 filesystem prior to the patches referenced below
Distributions shipping vulnerable Linux kernel builds with ocfs2 support enabled
Stable kernel branches addressed by commits 1524af3, 37f074e, 77d0295, c1de19e, and cd2d765

Discovery Timeline

2026-05-06 - CVE-2026-43076 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43076

Vulnerability Analysis

The vulnerability is a use-after-free condition in the ocfs2 directory handling code path. When ocfs2 stores small directories, the directory entries reside inline within the inode block itself rather than in separate data blocks. The inline storage region has a fixed maximum capacity tracked by id_count, while the logical directory size is recorded in i_size.

During inode read, ocfs2_validate_inode_block() performs structural sanity checks but never verifies that i_size fits within id_count. A corrupted or attacker-controlled filesystem can therefore present an inline-data inode with an i_size of approximately 1TB while the actual inline buffer holds fewer than 256 bytes. When ocfs2_dir_foreach_blk_id() walks directory entries up to i_size, it reads past the inline buffer into adjacent and eventually freed memory.

Root Cause

The root cause is missing input validation on filesystem metadata read from disk. The ocfs2_validate_inode_block() function trusts the on-disk i_size field for inodes flagged as containing inline data without bounding it against the inline capacity. This omission allows malformed metadata to drive subsequent directory iteration beyond the inline buffer.

Attack Vector

Exploitation requires the ability to mount a crafted ocfs2 image or to operate on a corrupted ocfs2 volume. In the syzbot reproducer, an inode reported i_size of 1099511627576 bytes against an id_count typically below 256 bytes. A garbage rec_len value of 54648 caused ctx->pos to advance out of bounds, and ocfs2_check_dir_entry() dereferenced freed memory, producing the use-after-free reported by KASAN. The upstream fix rejects such inodes at read time, preventing all downstream code from operating on invalid data. See the kernel patches 1524af3, 37f074e, 77d0295, c1de19e, and cd2d765 for the validation logic added to ocfs2_validate_inode_block().

Detection Methods for CVE-2026-43076

Indicators of Compromise

Kernel log entries from KASAN reporting use-after-free in ocfs2_check_dir_entry or ocfs2_dir_foreach_blk_id
Unexpected ocfs2 mount operations of removable media or user-supplied disk images on production systems
Kernel oops or panic traces referencing ocfs2 directory iteration with implausibly large i_size values

Detection Strategies

Audit kernel versions across the fleet and flag hosts running ocfs2-enabled kernels that predate the referenced stable patches
Monitor dmesg and journal output for ocfs2 directory validation warnings and KASAN reports
Alert on mount syscalls invoking the ocfs2 filesystem type from non-administrative contexts or from user-writable image files

Monitoring Recommendations

Forward kernel logs to a centralized analytics platform and search for ocfs2-related stack traces
Track loading of the ocfs2 kernel module on systems where it is not operationally required
Correlate filesystem mount events with the user account and process responsible to identify untrusted image mounts

How to Mitigate CVE-2026-43076

Immediate Actions Required

Apply the latest stable Linux kernel updates from your distribution that incorporate the ocfs2 inline data validation fix
Restrict mounting of ocfs2 filesystems to trusted administrators and verified storage sources
Disable automatic mounting of removable media on systems where ocfs2 is not required

Patch Information

The upstream fix adds a validation check in ocfs2_validate_inode_block() ensuring inodes with inline data have i_size <= id_count. The change is distributed across stable trees in commits 1524af3, 37f074e, 77d0295, c1de19e, and cd2d765. Apply the kernel update provided by your Linux distribution that includes the corresponding backport.

Workarounds

Blacklist the ocfs2 kernel module on hosts that do not require Oracle Cluster File System support
Enforce mount policies that prevent unprivileged users from mounting arbitrary filesystem images
Use kernel hardening options such as KASLR and SLAB freelist randomization to raise the cost of memory corruption exploitation

bash

# Configuration example
# Prevent the ocfs2 module from loading on systems that do not need it
echo 'install ocfs2 /bin/true' | sudo tee /etc/modprobe.d/blacklist-ocfs2.conf
sudo update-initramfs -u

# Verify the module is not currently loaded
lsmod | grep ocfs2