CVE-2026-89492: Linux Kernel OCFS2 Buffer Overflow Vulnerability

CVE-2026-89492 Overview

CVE-2026-89492 is an out-of-bounds read vulnerability in the Linux kernel's Oracle Cluster File System 2 (OCFS2) implementation. The flaw resides in the directory-index metadata validation logic, where ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() verify block ECC and signature but fail to bound ocfs2_dx_entry_list entry counts against block capacity. A crafted on-disk filesystem image can set de_num_used and de_count to 0xffff, causing ocfs2_dx_dir_search() to walk past the end of a 4KB metadata block. The condition is reachable through any path lookup, stat(), or open() on an indexed directory once the malicious image is mounted.

Critical Impact
A crafted OCFS2 filesystem image triggers a slab out-of-bounds read reachable from routine directory operations, exposing kernel memory contents to unprivileged users after mount.

Affected Products

Linux kernel — OCFS2 filesystem driver
Distributions shipping the affected kernel commits prior to the fix
Systems mounting OCFS2 volumes from untrusted sources

Discovery Timeline

2026-09-11 - CVE-2026-89492 published to NVD
2026-09-13 - Last updated in NVD database
Reported by 0sec automated security-research tooling

Technical Details for CVE-2026-89492

Vulnerability Analysis

The vulnerability affects OCFS2's indexed directory feature, which stores directory entries in hashed B-tree structures for faster lookup. When the kernel reads a directory-index leaf or root block from disk, the validation routines ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() confirm the block's error-correcting code and magic signature. Neither routine, however, verifies that the de_num_used and de_count fields in the embedded ocfs2_dx_entry_list remain within the physical capacity of the 4KB block.

A subsequent call to ocfs2_dx_dir_search() iterates entries using for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++) without any bounds enforcement. When de_num_used is set to 0xffff on disk, the loop reads far beyond the allocated slab object, producing a kernel memory disclosure.

Root Cause

An earlier fix, commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during block read"), added bounds checking for dr_list on non-inline dx_root blocks. The inline dr_entries code path and the dx_leafdl_list path were left unvalidated, allowing corrupted metadata to reach the search routine. The __counted_by_le() annotation on de_entries uses de_count as its bound, so an attacker-controlled de_count value defeats compiler-enforced bounds instrumentation as well.

Attack Vector

An attacker crafts an OCFS2 filesystem image with tampered directory-index entry counts and induces a target system to mount it. Automatic mounting of removable media, container image handling, or shared cluster storage are plausible delivery paths. Once mounted, any userland operation that traverses an indexed directory — ls, stat, open — triggers the out-of-bounds slab read. The disclosed memory can leak kernel pointers, cryptographic material, or adjacent object contents useful for chaining further exploitation.

See the upstream fix in the Linux kernel commit b8a5c0c3 for the corrected validation logic.

Detection Methods for CVE-2026-89492

Indicators of Compromise

Kernel log messages reporting -EFSCORRUPTED (-EUCLEAN) errors from OCFS2 after applying the patch
Unexpected mounts of OCFS2 filesystems from removable media or untrusted network sources
Kernel oops or KASAN slab-out-of-bounds reports referencing ocfs2_dx_dir_search

Detection Strategies

Enable KASAN (Kernel Address Sanitizer) on test and staging kernels to surface out-of-bounds reads originating in the OCFS2 code path
Audit dmesg and journal logs for OCFS2 validator warnings mentioning dx_leaf or dx_root corruption
Inventory hosts with the OCFS2 module loaded (lsmod | grep ocfs2) and confirm patch status of the running kernel

Monitoring Recommendations

Alert on mount syscalls specifying -t ocfs2 from non-standard sources or automount daemons
Track kernel version and OCFS2 module hash across the fleet to identify unpatched systems
Monitor for filesystem corruption events correlated with directory enumeration by unprivileged users

How to Mitigate CVE-2026-89492

Immediate Actions Required

Apply the upstream kernel patch or vendor-provided update that adds de_count and de_num_used validation to both ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root()
Restrict mount privileges so that only trusted administrators can attach OCFS2 volumes
Disable automatic mounting of removable media on systems that do not require it

Patch Information

The fix is committed in the mainline and stable trees. Review the following upstream commits for the corrected validators: b8a5c0c32df2, bc70726ddad5, and fcfcba8fe17d. The patch enforces that de_count equals ocfs2_dx_entries_per_leaf() or ocfs2_dx_entries_per_root() and that de_num_used does not exceed de_count, returning -EFSCORRUPTED when either check fails.

Workarounds

Unload the OCFS2 kernel module on hosts that do not require it: modprobe -r ocfs2
Blacklist the OCFS2 module in /etc/modprobe.d/ to prevent autoload on untrusted systems
Enforce mount policy through udev rules or SELinux/AppArmor to block OCFS2 mounts from user-writable devices

bash

# Prevent OCFS2 module autoload on systems that do not require it
echo "install ocfs2 /bin/true" | sudo tee /etc/modprobe.d/disable-ocfs2.conf
sudo modprobe -r ocfs2 2>/dev/null || true

# Verify running kernel version against patched builds
uname -r