{"id":25613,"date":"2026-09-18T04:31:38","date_gmt":"2026-09-17T20:31:38","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90204"},"modified":"2026-09-18T04:31:38","modified_gmt":"2026-09-17T20:31:38","slug":"cve-2026-90204","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90204","title":{"rendered":"CVE-2026-90204 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate DIO o"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ocfs2: validate DIO orphan slot during inode read<\/p>\n<p>[BUG]<br \/>\nA corrupted append-DIO dinode (high byte at offset 0xa1<br \/>\ncorrupted from 0 to 1) can carry an i_dio_orphaned_slot<br \/>\noutside the mounted filesystem slot range and trigger a<br \/>\nuse-after-free error:<\/p>\n<p>BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780\/0x820 fs\/ocfs2\/sysfile.c:102<br \/>\nRead of size 8 at addr ffff88800b767c00 by task kworker\/u8:3\/85<br \/>\nCall Trace:<br \/>\n &#8230;<br \/>\n ocfs2_get_system_file_inode+0x780\/0x820 fs\/ocfs2\/sysfile.c:102<br \/>\n ocfs2_wipe_inode+0x292\/0xf70 fs\/ocfs2\/inode.c:840<br \/>\n ocfs2_delete_inode fs\/ocfs2\/inode.c:1155 [inline]<br \/>\n ocfs2_evict_inode+0x6c9\/0x1170 fs\/ocfs2\/inode.c:1295<br \/>\n evict+0x38e\/0x8f0 fs\/inode.c:810<br \/>\n iput_final fs\/inode.c:1914 [inline]<br \/>\n iput fs\/inode.c:1966 [inline]<br \/>\n iput+0x55b\/0x8b0 fs\/inode.c:1926<br \/>\n ocfs2_recover_orphans+0x610\/0xe40 fs\/ocfs2\/journal.c:2374<br \/>\n ocfs2_complete_recovery+0x5af\/0xd00 fs\/ocfs2\/journal.c:1373<br \/>\n &#8230;<\/p>\n<p>[CAUSE]<br \/>\nocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the<br \/>\nslot-local system inode cache. The dinode validator does not check<br \/>\nthis active slot, so an out-of-range value produces an invalid cache<br \/>\nentry pointer that is dereferenced as an inode pointer.<\/p>\n<p>[FIX]<br \/>\nReject an active i_dio_orphaned_slot outside the slot range during<br \/>\ndinode validation, before DIO orphan recovery can consume it.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ocfs2: validate DIO orphan slot during inode read<\/p>\n<p>[BUG]<br \/>\nA corrupted append-DIO dinode (high byte at offset 0xa1<br \/>\ncorrupted from 0 t<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25613","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}