CVE-2026-63796 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: reject oversized group bitmap descriptors
ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap.
Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used.
Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_add_and_move+0x1f5/0x3d0 (?:?) ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemap_add_folio+0x105/0x1f0 (?:?) ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?) down_write+0xf5/0x180 (?:?) ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?) __mark_inode_dirty+0x758/0x9a0 (?:?) inode_to_bdi+0x41/0x90 (?:?) balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?) generic_perform_write+0x252/0x440 (?:?) mnt_put_write_access_file+0x16/0x70 (?:?) file_update_time_flags+0xe4/0x200 (?:?) ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lock_acquire+0x184/0x2f0 (?:?) ksys_write+0xd2/0x170 (?:?) apparmor_file_permission+0xf5/0x310 (?:?) read_zero+0x8d/0x140 (?:?) lock_is_held_type+0x8f/0x100 (?:?)
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability in the Linux kernel's ocfs2 filesystem implementation stems from insufficient validation of group bitmap descriptors, specifically within the ocfs2_validate_gd_parent() function. This flaw allows for a maliciously crafted descriptor to specify bitmap dimensions that exceed the actual physical capacity of the group descriptor block. The issue manifests as a use-after-free condition in KASAN reports, where memory access violations occur during bitmap scanning operations. The root cause lies in the fact that while the existing validation bounds bg_bits against parent allocator chain geometry, it fails to verify whether the claimed bg_size or bg_bits actually fit within the physical constraints of the bitmap bytes available in the group descriptor block.
The technical exploitation occurs when ocfs2 processes oversized group bitmap descriptors that claim more bits than can physically exist within their allocated storage space. This leads to memory access violations as later operations attempt to scan and update bitmap data beyond the legitimate boundaries of the allocated buffer. The call trace demonstrates this progression through various kernel subsystems including suballocator functions, cluster group searches, and memory management routines. When ocfs2_find_max_contig_free_bits attempts to process these invalid descriptors, it triggers a use-after-free scenario in _find_next_bit function where it reads beyond valid memory boundaries. This vulnerability represents a classic case of buffer overflow that can be leveraged for arbitrary code execution or system instability.
The operational impact extends beyond simple memory corruption to potentially enable privilege escalation and denial-of-service conditions within systems utilizing ocfs2 filesystems. Attackers could craft malicious descriptors to cause kernel crashes, data corruption, or even execute unauthorized code within kernel space. The vulnerability affects the integrity of the cluster group allocation subsystem and can compromise the stability of enterprise storage environments relying on OCFS2 for shared storage management. This issue aligns with CWE-129 Input Validation and CWE-787 Out-of-bounds Write categories from the Common Weakness Enumeration, and maps to ATT&CK technique T1068 Exploitation for Privilege Escalation and T1499 Endpoint Denial of Service within the MITRE ATT&CK framework.
Mitigation strategies include implementing a physical capacity check based on ocfs2_group_bitmap_size() for the parent allocator type, ensuring that group bitmap descriptors cannot claim more space than physically available in their respective blocks. The fix maintains the existing chain geometry validation while adding the new physical capacity verification to create a dual-layer defense mechanism. This approach prevents attackers from exploiting the mismatch between on-disk layout and actual physical storage capacity. System administrators should apply kernel updates immediately, as this vulnerability affects the core filesystem subsystem and can be exploited remotely or locally depending on system configuration. The solution aligns with secure coding practices that emphasize bounds checking and input validation to prevent buffer overflows and memory corruption vulnerabilities.