CVE-2026-63796

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject oversized group bitmap descriptors

ocfs2_validate_gd_parent() only bounds bg_bits against the parent

allocator's chain geometry. A malicious descriptor can still claim a

bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in

the group descriptor block, so later bitmap scans and bit updates can run

past bg_bitmap.

Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent

allocator type and reject descriptors whose bg_size or bg_bits exceed that

capacity. Keep the existing chain geometry check so both the on-disk

bitmap layout and the allocator metadata must agree before the descriptor

is used.

Validation reproduced this kernel report:

KASAN use-after-free in _find_next_bit+0x7f/0xc0

Read of size 8

Call trace:

dump_stack_lvl+0x66/0xa0 (?:?)

print_report+0xd0/0x630 (?:?)

_find_next_bit+0x7f/0xc0 (?:?)

srso_alias_return_thunk+0x5/0xfbef5 (?:?)

__virt_addr_va

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References