CVE-2026-72164 ocfs2: avoid moving extents to occupied clusters
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-72164?
CVE-2026-72164 is a high-severity vulnerability in Linux, published on 15 Aug 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: avoid moving extents to occupied clusters
For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and expects ocfs2_probe_alloc_group() to replace it with a free run in the target block group.
The probe currently leaves *phys_cpos unchanged if the scan reaches the end of the group without finding a free run. An occupied goal at the last bit can therefore survive the probe and be passed to __ocfs2_move_extent(), which copies file data into a cluster still owned by another inode before the bitmap is updated.
When the probe does find a free run, it also subtracts move_len from the ending bit. The start of an N-bit run ending at i is i - N + 1, so the current calculation can report the bit immediately before the free run.
Clear *phys_cpos before scanning and use the correct free-run start. Callers already treat a zero result as -ENOSPC, so failed probes no longer continue with an occupied caller-controlled goal.
Which versions are affected by CVE-2026-72164?
How do I fix CVE-2026-72164?
Upgrade to a fixed version.
Is CVE-2026-72164 being exploited?
There is no known exploitation of CVE-2026-72164 in the wild and no public exploit code.
Sources
Also known as BELL-CVE-2026-72164, DEBIAN-CVE-2026-72164, GHSA-5r4j-cfqp-hv7w, UBUNTU-CVE-2026-72164.