CVE-2026-89493

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate rl_used against rl_count in refcount block validator

ocfs2_find_refcount_rec_in_rl() walks the on-disk refcount record array

with:

for (; i < le16_to_cpu(rb->rf_records.rl_used); i++) {

rec = &rb->rf_records.rl_recs[i];

...

rl_recs[] lives in a single metadata block (4096 bytes on the common

configuration), so its real capacity is fixed by

ocfs2_refcount_recs_per_rb(sb) (247 records for a 4K block with the

16-byte ocfs2_refcount_rec). rl_used and rl_count are both read directly

off disk by ocfs2_validate_refcount_block() and are never checked against

that capacity, nor against each other, before any refcount/reflink/CoW

operation walks the array.

A crafted (or corrupted) refcount block with rl_used == 0xffff makes the

loop above walk far past the end of the block, dereferencing rl_recs[i]

for i up to 65534. The resulting index is then handed to the sibling

ocfs2_insert_refcount_rec(), whose

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References