{"id":25614,"date":"2026-09-18T04:31:38","date_gmt":"2026-09-17T20:31:38","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90205"},"modified":"2026-09-18T04:31:38","modified_gmt":"2026-09-17T20:31:38","slug":"cve-2026-90205","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-90205","title":{"rendered":"CVE-2026-90205 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate orpha"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ocfs2: validate orphan slot during inode read<\/p>\n<p>Patch series &#8220;ocfs2: validate active orphan slots during inode read&#8221;.<\/p>\n<p>OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.<br \/>\nA corrupted slot can therefore index osb_orphan_wipes or the slot-local<br \/>\nsystem-inode cache outside their allocations before the corruption is<br \/>\nreported.<\/p>\n<p>Patch 1 validates the ordinary orphan slot used by inode wipe processing.<br \/>\nPatch 2 validates the append-DIO orphan slot used by DIO completion and<br \/>\norphan recovery.  Both checks reject corrupt metadata at the existing inode<br \/>\nvalidation boundary.<\/p>\n<p>This patch (of 2):<\/p>\n<p>[BUG]<br \/>\nA corrupted dinode with OCFS2_ORPHANED_FL can carry an<br \/>\ni_orphaned_slot outside the mounted filesystem slot range.<br \/>\nocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking<br \/>\nup the orphan directory, causing an out-of-bounds memory access.<\/p>\n<p>BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780\/0x820 fs\/ocfs2\/sysfile.c:102<br \/>\nRead of size 8 at addr ffff88800b767c00 by task kworker\/u8:3\/85<br \/>\nCall Trace:<br \/>\n &#8230;<br \/>\n ocfs2_get_system_file_inode+0x780\/0x820 fs\/ocfs2\/sysfile.c:102<br \/>\n ocfs2_wipe_inode+0x292\/0xf70 fs\/ocfs2\/inode.c:840<br \/>\n ocfs2_delete_inode fs\/ocfs2\/inode.c:1155 [inline]<br \/>\n ocfs2_evict_inode+0x6c9\/0x1170 fs\/ocfs2\/inode.c:1295<br \/>\n evict+0x38e\/0x8f0 fs\/inode.c:810<br \/>\n iput_final fs\/inode.c:1914 [inline]<br \/>\n iput fs\/inode.c:1966 [inline]<br \/>\n iput+0x55b\/0x8b0 fs\/inode.c:1926<br \/>\n ocfs2_recover_orphans+0x610\/0xe40 fs\/ocfs2\/journal.c:2374<br \/>\n ocfs2_complete_recovery+0x5af\/0xd00 fs\/ocfs2\/journal.c:1373<br \/>\n &#8230;<\/p>\n<p>[CAUSE]<br \/>\nocfs2_validate_inode_block() validates i_suballoc_slot but leaves<br \/>\nthe active ordinary orphan slot unchecked. Downstream consumers<br \/>\nassume that the value is smaller than osb-&gt;max_slots.<\/p>\n<p>[FIX]<br \/>\nReject an active i_orphaned_slot outside the slot range during<br \/>\ndinode validation, before the inode reaches orphan wipe processing.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>ocfs2: validate orphan slot during inode read<\/p>\n<p>Patch series &#8220;ocfs2: validate active orphan slots during inode read&#8221;.<\/p>\n<p>OCFS2 trusts <\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25614","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25614","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25614"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25614"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25614"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}