CVE-2026-90205

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate orphan slot during inode read

Patch series "ocfs2: validate active orphan slots during inode read".

OCFS2 trusts active ordinary and append-DIO orphan slots read from dinodes.

A corrupted slot can therefore index osb_orphan_wipes or the slot-local

system-inode cache outside their allocations before the corruption is

reported.

Patch 1 validates the ordinary orphan slot used by inode wipe processing.

Patch 2 validates the append-DIO orphan slot used by DIO completion and

orphan recovery. Both checks reject corrupt metadata at the existing inode

validation boundary.

This patch (of 2):

[BUG]

A corrupted dinode with OCFS2_ORPHANED_FL can carry an

i_orphaned_slot outside the mounted filesystem slot range.

ocfs2_wipe_inode() uses it to index osb_orphan_wipes before looking

up the orphan directory, causing an out-of-bounds memory access.

BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References