CVE-2026-63796High· 8.8▾ Twilight

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor …

▾ Twilight zone — High severity, or a signal on a lesser flaw

Depth score49/ 100 · Moderate

impact 48.4 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 19, 2026

Updated

Jul 19, 2026

CVSS

8.8

Vendor

Linux

Product

Linux

CWE

—

Depth score

49 · Moderate

EPSS

0.59% · p48

Platforms

—

Source

NVD

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

decided 2026-10-16

Exploitation: none
Automatable: no
Technical impact: total

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.

EPSS history

Exploit-prediction probability, daily snapshots since Aug 4.

0.5% → 0.6%▲ 0.1%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

5 events · 99 days

Jul 19, 2026Published
Disclosed via NVD
Aug 4, 2026EPSS first tracked
0.5%
Oct 16, 2026CVSS changed
— → 8.8
Oct 16, 2026Severity changed
none → high
Oct 26, 2026EPSS peak
0.5% → 0.6%

Linux #nvd #cve.org

Affected

Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 336340a0f8a141df8a4eb21a5a86f8ffb87769f6
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 296c6a42b1174395935ca4cfe8f393e37b698d54
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < c5a125eadba05ba421c4b55e68da22b4a40d32b4
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 8f9903b0cdbb3155a8899410330b4b4d583a7a5c
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 4cd57ebee395041099fcdfcabb00749ce38d8b27
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 99c21e7263248c3f084756bfae08163cc5d6c62f
Linux >= ccd979bdbce9fba8412beb3f1de68a9d0171b12c < 9bd541e09dffff27e5bec0f9f45b0228173a5375
Linux 2.6.16

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject oversized group bitmap descriptors

ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap.

Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used.

Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_add_and_move+0x1f5/0x3d0 (?:?) ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemap_add_folio+0x105/0x1f0 (?:?) ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?) down_write+0xf5/0x180 (?:?) ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?) __mark_inode_dirty+0x758/0x9a0 (?:?) inode_to_bdi+0x41/0x90 (?:?) balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?) generic_perform_write+0x252/0x440 (?:?) mnt_put_write_access_file+0x16/0x70 (?:?) file_update_time_flags+0xe4/0x200 (?:?) ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lock_acquire+0x184/0x2f0 (?:?) ksys_write+0xd2/0x170 (?:?) apparmor_file_permission+0xf5/0x310 (?:?) read_zero+0x8d/0x140 (?:?) lock_is_held_type+0x8f/0x100 (?:?)

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Change history

Field changes observed since this record was first indexed.

Oct 16, 2026CVSS — → 8.8
Oct 16, 2026Severity none → high

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd#cve.org