CVE-2026-72162

CVE CVE-2026-72162EUVD EUVD-2026-58920Published 2026-08-15T05:53:30.000ZLast changed 2026-08-18T06:56:14.000ZCVSS 7.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec [BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux patch: 0; patch: 6.18.40; dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 <671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1; patch: 7.2; dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 <452a8467be8143747292218212671deeb186d2ae; dcd0538ff4e854fa9d7f4630b359ca8fdb5cb5a8 <858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85; 2.6.22; patch: 7.1.5

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.