CVE-2026-53040

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53040", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.380Z", "datePublished": "2026-06-24T16:29:46.737Z", "dateUpdated": "2026-08-05T12:32:48.568Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:32:48.568Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate bg_bits during freefrag scan\n\n[BUG]\nA crafted filesystem can trigger an out-of-bounds bitmap walk when\nOCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.\n\nBUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nRead of size 8 at addr ffff888031bce000 by task syz.0.636/1435\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186 [inline]\n kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200\n __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n test_bit_le include/asm-generic/bitops/le.h:21 [inline]\n ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\n ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\n ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\n ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\n ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828\n ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n ...\n\n[CAUSE]\nocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the\nbitmap scan limit. The coherent path reads group descriptors through\nocfs2_read_group_descriptor(), which validates the descriptor before\nuse. The non-coherent path uses ocfs2_read_blocks_sync() instead and\nskips that validation, so an impossible bg_bits value can drive the\nbitmap walk past the end of the block.\n\n[FIX]\nCompute the bitmap capacity from the filesystem format with\nocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds\nthat limit, and clamp the scan to the computed capacity. This keeps the\nfreefrag report going while avoiding reads beyond the buffer."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through the local `OCFS2_IOC_INFO` ioctl on an opened OCFS2 file or directory, not by network packet processing. A crafted OCFS2 filesystem/metadata is required, but the trigger is a local syscall path.\nAC:L - There is no race or timing dependency; the attacker supplies the non-coherent freefrag request and an impossible on-disk `bg_bits` value. Once the crafted metadata is present, the out-of-bounds bitmap walk is deterministic.\nPR:L - `OCFS2_IOC_INFO` has no capability check, and ordinary local users can issue it against an accessible mounted OCFS2 file. Although mounting or creating the crafted block device is privileged because OCFS2 is not `FS_USERNS_MOUNT`, the direct ioctl trigger is available to a low-privileged local user, so the higher-severity PR:L is chosen.\nUI:N - No victim action is required for a local attacker who can access the mounted OCFS2 filesystem and issue the ioctl. The vulnerable request is initiated entirely by the attacker-controlled process.\nS:U - The impact remains within the kernel/filesystem security authority on the same host. There is no VM, IOMMU, container-boundary, or cross-authority escape specific to this bug.\nC:H - The bug is an out-of-bounds read past the group bitmap buffer, and the requested guidance treats non-trivially bounded out-of-bounds reads as high confidentiality impact. The read can cover more than a few bytes of adjacent kernel memory and influence data returned in freefrag statistics.\nI:N - The vulnerable loop only tests bitmap bits and updates local free-fragmentation counters; it does not write beyond the buffer or provide a write primitive. I found no control-flow or metadata modification path from the invalid `bg_bits` read.\nA:H - The reported failure is a KASAN use-after-free/out-of-bounds read in kernel context, and such invalid kernel memory access can oops or panic the system. The crafted request can be issued repeatedly once the filesystem is accessible."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/ioctl.c"], "versions": [{"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "bb2906a1065ec28de021bac2ed03f2624edd7d07", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "3e167e230d19cd273108bab2e4c61800fc335ae8", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "0998674eec138c55e9e349b9cbd9dbc5129a9cc8", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "bb3c54d1e71578521111f1a1ee7d5f4761a242b8", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "4c2d62ddde8928db12f4608950b67a20e67deab2", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "e0dcf12665d6dde37facf790803cdad44d5c328c", "status": "affected", "versionType": "git"}, {"version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "lessThan": "8f687eeed3da3012152b0f9473f578869de0cd7b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/ioctl.c"], "versions": [{"version": "3.0", "status": "affected"}, {"version": "0", "lessThan": "3.0", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.0", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07"}, {"url": "https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8"}, {"url": "https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8"}, {"url": "https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8"}, {"url": "https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e"}, {"url": "https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2"}, {"url": "https://git.kernel.org/stable/c/e0dcf12665d6dde37facf790803cdad44d5c328c"}, {"url": "https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b"}], "title": "ocfs2: validate bg_bits during freefrag scan", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "bb2906a1065ec28de021bac2ed03f2624edd7d07", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "3e167e230d19cd273108bab2e4c61800fc335ae8", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "0998674eec138c55e9e349b9cbd9dbc5129a9cc8", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "bb3c54d1e71578521111f1a1ee7d5f4761a242b8", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "4c2d62ddde8928db12f4608950b67a20e67deab2", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "e0dcf12665d6dde37facf790803cdad44d5c328c", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}, {"lessThan": "8f687eeed3da3012152b0f9473f578869de0cd7b", "status": "affected", "version": "d24a10b9f8ed548981696cd36e2b4f16e6f360b1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/ioctl.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.0"}, {"lessThan": "3.0", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "ADE9309F-1058-4BD7-8F94-3FE94CF5B8A4", "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.0", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate bg_bits during freefrag scan\n\n[BUG]\nA crafted filesystem can trigger an out-of-bounds bitmap walk when\nOCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.\n\nBUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nRead of size 8 at addr ffff888031bce000 by task syz.0.636/1435\nCall Trace:\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0xd1/0x650 mm/kasan/report.c:482\n kasan_report+0xfb/0x140 mm/kasan/report.c:595\n check_region_inline mm/kasan/generic.c:186 [inline]\n kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200\n __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\n instrument_atomic_read include/linux/instrumented.h:68 [inline]\n _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\n test_bit_le include/asm-generic/bitops/le.h:21 [inline]\n ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\n ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\n ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\n ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\n ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828\n ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913\n vfs_ioctl fs/ioctl.c:51 [inline]\n __do_sys_ioctl fs/ioctl.c:597 [inline]\n __se_sys_ioctl fs/ioctl.c:583 [inline]\n __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n ...\n\n[CAUSE]\nocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the\nbitmap scan limit. The coherent path reads group descriptors through\nocfs2_read_group_descriptor(), which validates the descriptor before\nuse. The non-coherent path uses ocfs2_read_blocks_sync() instead and\nskips that validation, so an impossible bg_bits value can drive the\nbitmap walk past the end of the block.\n\n[FIX]\nCompute the bitmap capacity from the filesystem format with\nocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds\nthat limit, and clamp the scan to the computed capacity. This keeps the\nfreefrag report going while avoiding reads beyond the buffer."}], "id": "CVE-2026-53040", "lastModified": "2026-07-14T19:33:51.517", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-06-24T17:17:15.687", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0998674eec138c55e9e349b9cbd9dbc5129a9cc8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3e167e230d19cd273108bab2e4c61800fc335ae8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4c2d62ddde8928db12f4608950b67a20e67deab2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8f687eeed3da3012152b0f9473f578869de0cd7b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bb2906a1065ec28de021bac2ed03f2624edd7d07"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bb3c54d1e71578521111f1a1ee7d5f4761a242b8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e0dcf12665d6dde37facf790803cdad44d5c328c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: ocfs2: validate bg_bits during freefrag scan", "id": "2492294", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492294"}, "csaw": false, "cwe": "CWE-1285", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocfs2: validate bg_bits during freefrag scan\n[BUG]\nA crafted filesystem can trigger an out-of-bounds bitmap walk when\nOCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT.\nBUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline]\nBUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\nBUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nBUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nRead of size 8 at addr ffff888031bce000 by task syz.0.636/1435\nCall Trace:\n__dump_stack lib/dump_stack.c:94 [inline]\ndump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120\nprint_address_description mm/kasan/report.c:378 [inline]\nprint_report+0xd1/0x650 mm/kasan/report.c:482\nkasan_report+0xfb/0x140 mm/kasan/report.c:595\ncheck_region_inline mm/kasan/generic.c:186 [inline]\nkasan_check_range+0x11c/0x200 mm/kasan/generic.c:200\n__kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31\ninstrument_atomic_read include/linux/instrumented.h:68 [inline]\n_test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline]\ntest_bit_le include/asm-generic/bitops/le.h:21 [inline]\nocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline]\nocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline]\nocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline]\nocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754\nocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828\nocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913\nvfs_ioctl fs/ioctl.c:51 [inline]\n__do_sys_ioctl fs/ioctl.c:597 [inline]\n__se_sys_ioctl fs/ioctl.c:583 [inline]\n__x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583\n...\n[CAUSE]\nocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the\nbitmap scan limit. The coherent path reads group descriptors through\nocfs2_read_group_descriptor(), which validates the descriptor before\nuse. The non-coherent path uses ocfs2_read_blocks_sync() instead and\nskips that validation, so an impossible bg_bits value can drive the\nbitmap walk past the end of the block.\n[FIX]\nCompute the bitmap capacity from the filesystem format with\nocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds\nthat limit, and clamp the scan to the computed capacity. This keeps the\nfreefrag report going while avoiding reads beyond the buffer.", "A flaw was found in the Oracle Cluster File System Release 2 (OCFS2) in the Linux kernel. A local attacker with the ability to craft a malicious OCFS2 filesystem could trigger a use-after-free vulnerability. This occurs when the OCFS2_IOC_INFO ioctl is issued with the OCFS2_INFO_FL_NON_COHERENT flag, leading to an out-of-bounds bitmap walk. This flaw could result in a denial of service, causing system instability or crashes."], "name": "CVE-2026-53040", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53040\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53040\nhttps://lore.kernel.org/linux-cve-announce/2026062456-CVE-2026-53040-e3ea@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,bb2906a1065ec28de021bac2ed03f2624edd7d07)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,3e167e230d19cd273108bab2e4c61800fc335ae8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,0998674eec138c55e9e349b9cbd9dbc5129a9cc8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,bb3c54d1e71578521111f1a1ee7d5f4761a242b8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,05d0cbea41167b6b061c6ba5b70ee5a9a7a24c9e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,4c2d62ddde8928db12f4608950b67a20e67deab2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,e0dcf12665d6dde37facf790803cdad44d5c328c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[d24a10b9f8ed548981696cd36e2b4f16e6f360b1,8f687eeed3da3012152b0f9473f578869de0cd7b)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.0"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.258,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1,*)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T19:30:08.644768+00:00", "updated": "2026-08-12T06:30:17.201595+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}