CVE-2026-72163

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix NULL h_transaction deref in ocfs2_assure_trans_credits

[BUG]

A direct write over unwritten extents can panic the kernel in

ocfs2_assure_trans_credits() when the journal aborts during DIO

completion. The crash is a general protection fault from a NULL pointer

dereference.

[CAUSE]

ocfs2_dio_end_io_write() loops over a direct write's unwritten extents,

marking each written under a single journal handle. If the journal

aborts (for example after an I/O error) while the extent tree is being

updated, the handle is left aborted with its transaction pointer

cleared. The extent merge treats that failure as not critical and

reports success, so the loop keeps using the handle.

ocfs2_assure_trans_credits() reads the handle's remaining credits

without first checking whether the handle is aborted, and that read

dereferences the cleared transaction pointer.

[FIX]

A journal abort is recorded in the handle itself, so call

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References