Answer in brief
CVE-2026-72162 records a Unknown severity vulnerability in ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <452a8467be8143747292218212671deeb186d2ae || >=0 <6.18.40 || >=0 <7.1.5 | 671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1, 858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85, 452a8467be8143747292218212671deeb186d2ae, 6.18.40, 7.1.5 |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec [BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-72162 records a Unknown severity vulnerability in ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85 || >=1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <452a8467be8143747292218212671deeb186d2ae || >=0 <6.18.40 || >=0 <7.1.5 | 671889c553ea55e2da6a4f3b15f4c0fa40f2f0d1, 858aa4965ffa8c0d4bb5dd835ac4f1c9a1dcab85, 452a8467be8143747292218212671deeb186d2ae, 6.18.40, 7.1.5 |
Published upstream
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 15, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 15, 2026
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec [BUG] On-disk corruption setting l_next_free_rec to 0 in an inode's embedded extent list triggers a UBSAN panic on the next write to that file. [CAUSE] ocfs2_sum_rightmost_rec() computes i = le16_to_cpu(el->l_next_free_rec) - 1 and accesses el->l_recs[i] without validating i. When l_next_free_rec is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls past the end of the array. Either case violates the __counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN. [FIX] Validate the inode's embedded extent list when the inode is read, in ocfs2_validate_inode_block(): l_count must be non-zero and no larger than the inode block can hold, and l_next_free_rec must not exceed l_count. A corrupt list is rejected at read time, before the b-tree code can index l_recs[] out of bounds.
Quoted source text, attributed separately from HOL analysis.