CVE-2026-43075
published 2026-05-06CVE-2026-43075: In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline KASAN reports a use-after-free…
PriorityP342high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.13%
2.6th percentile
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
KASAN reports a use-after-free write of 4086 bytes in
ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a
copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on
a loop device. The actual bug is an out-of-bounds write past the inode
block buffer, not a true use-after-free. The write overflows into an
adjacent freed page, which KASAN reports as UAF.
The root cause is that ocfs2_try_to_write_inline_data trusts the on-disk
id_count field to determine whether a write fits in inline data. On a
corrupted filesystem, id_count can exceed the physical maximum inline data
capacity, causing writes to overflow the inode block buffer.
Call trace (crash path):
vfs_copy_file_range (fs/read_write.c:1634)
do_splice_direct
splice_direct_to_actor
iter_file_splice_write
ocfs2_file_write_iter
generic_perform_write
ocfs2_write_end
ocfs2_write_end_nolock (fs/ocfs2/aops.c:1949)
ocfs2_write_end_inline (fs/ocfs2/aops.c:1915)
memcpy_from_folio <-- KASAN: write OOB
So add id_count upper bound check in ocfs2_validate_inode_block() to
alongside the existing i_size check to fix it.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea | 68f9cc3bbf2ae501770cea7dc0005fc9a85e48ea |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e | 2e6a254f9cedf51b75cc20b8b92e2209bfa04c3e |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 22df7d4de9c5cd42edf855a1de25f2106088c4c6 | 22df7d4de9c5cd42edf855a1de25f2106088c4c6 |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < e2c9dc6b6e96f3585f2a1062ca3374a52db0938f | e2c9dc6b6e96f3585f2a1062ca3374a52db0938f |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 947f953978b0d9463498d548d0f054f5a75be2e9 | 947f953978b0d9463498d548d0f054f5a75be2e9 |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 0c1af902223b6fcedb60904ca0b551254686c7b9 | 0c1af902223b6fcedb60904ca0b551254686c7b9 |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 69d3c69ade1e4285ab4ca48fe7acee0767e65604 | 69d3c69ade1e4285ab4ca48fe7acee0767e65604 |
| linux | linux | >= 1afc32b952335f665327a1a9001ba1b44bb76fd9 < 7bc5da4842bed3252d26e742213741a4d0ac1b14 | 7bc5da4842bed3252d26e742213741a4d0ac1b14 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 2.6.24.1 < 6.6.136 | 6.6.136 |
| linux | linux_kernel | >= 6.13 < 6.18.24 | 6.18.24 |
| linux | linux_kernel | >= 6.19 < 6.19.14 | 6.19.14 |
| linux | linux_kernel | >= 6.7 < 6.12.83 | 6.12.83 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13 ocfs2 fs/read_write.c ocfs2_validate_inode_block id_count use after free (WID-SEC-2026-1385)
vuldb·2026-05-07
CVE-2026-43075 [CRITICAL] Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13 ocfs2 fs/read_write.c ocfs2_validate_inode_block id_count use after free (WID-SEC-2026-1385)
A vulnerability was found in Linux Kernel up to 6.6.135/6.12.82/6.18.23/6.19.13. It has been rated as critical. Affected is the function ocfs2_validate_inode_block of the file fs/read_write.c of the component ocfs2. Performing a manipulation of the argument id_count results in use after free.
This vulnerability is known as CVE-2026-43075. Access to the local network is required for this attack. No exploit is available.
Upgrading the affected component is advised.
GHSA
GHSA-v76q-g5wv-jjw6: In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
KASAN reports a use-aft
ghsa_unreviewed·2026-05-06
CVE-2026-43075 GHSA-v76q-g5wv-jjw6: In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
KASAN reports a use-aft
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
KASAN reports a use-after-free write of 4086 bytes in
ocfs2_write_end_inline, called from ocfs2_write_end_nolock during a
copy_file_range splice fallback on a corrupted ocfs2 filesystem mounted on
a loop device. The actual bug is an out-of-bounds write past the inode
block buffer, not a true use-after-free. The write overflows into an
adjacent freed page, which KASAN reports as UAF.
The root cause is that ocfs2_try_to_write_inline_data trusts the on-disk
id_count field to determine whether a write fits in inline data. On a
corrupted filesystem, id_count can exceed the physical maximum inline data
capacity, causing writes to overflow the inode block buffer.
Call t
Red Hat
kernel: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
vendor_redhat·2026-05-06
CVE-2026-43075 CWE-1284 kernel: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
kernel: ocfs2: fix out-of-bounds write in ocfs2_write_end_inline
A flaw was found in the Linux kernel's ocfs2 filesystem component. This vulnerability allows a local attacker, by mounting a specially crafted and corrupted ocfs2 filesystem on a loop device, to trigger an out-of-bounds write. This occurs because the system incorrectly trusts the `id_count` field from the on-disk filesystem, which can lead to memory corruption. The most significant consequence is potential system instability or denial of service.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterpris
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/0c1af902223b6fcedb60904ca0b551254686c7b9https://git.kernel.org/stable/c/22df7d4de9c5cd42edf855a1de25f2106088c4c6https://git.kernel.org/stable/c/2e6a254f9cedf51b75cc20b8b92e2209bfa04c3ehttps://git.kernel.org/stable/c/68f9cc3bbf2ae501770cea7dc0005fc9a85e48eahttps://git.kernel.org/stable/c/69d3c69ade1e4285ab4ca48fe7acee0767e65604https://git.kernel.org/stable/c/7bc5da4842bed3252d26e742213741a4d0ac1b14https://git.kernel.org/stable/c/947f953978b0d9463498d548d0f054f5a75be2e9https://git.kernel.org/stable/c/e2c9dc6b6e96f3585f2a1062ca3374a52db0938f
2026-05-06
Published