{"id":"CVE-2026-63796","revision":null,"records":[{"revision":"9cc87d1188624efeae202735fa8a69f2","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-63796","aliases":[],"title":"ocfs2: reject oversized group bitmap descriptors","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject oversized group bitmap descriptors\n\nocfs2_validate_gd_parent() only bounds bg_bits against the parent\nallocator's chain geometry. A malicious descriptor can still claim a\nbg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in\nthe group descriptor block, so later bitmap scans and bit updates can run\npast bg_bitmap.\n\nAdd a physical-cap check based on ocfs2_group_bitmap_size() for the parent\nallocator type and reject descriptors whose bg_size or bg_bits exceed that\ncapacity. Keep the existing chain geometry check so both the on-disk\nbitmap layout and the allocator metadata must agree before the descriptor\nis used.\n\nValidation reproduced this kernel report:\nKASAN use-after-free in _find_next_bit+0x7f/0xc0\nRead of size 8\nCall trace:\n dump_stack_lvl+0x66/0xa0 (?:?)\n print_report+0xd0/0x630 (?:?)\n _find_next_bit+0x7f/0xc0 (?:?)\n srso_alias_return_thunk+0x5/0xfbef5 (?:?)\n __virt_addr_valid+0x188/0x2f0 (?:?)\n kasan_report+0xe4/0x120 (?:?)\n ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)\n ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)\n ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)\n ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)\n ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)\n get_page_from_freelist+0x70e/0x2370 (?:?)\n lock_release+0xc6/0x290 (?:?)\n do_raw_spin_unlock+0x9a/0x100 (?:?)\n kasan_unpoison+0x27/0x60 (?:?)\n __bfs+0x147/0x240 (?:?)\n get_page_from_freelist+0x83d/0x2370 (?:?)\n ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)\n sched_domains_numa_masks_clear+0x70/0xd0 (?:?)\n check_irq_usage+0xe8/0xb70 (?:?)\n __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)\n check_path+0x24/0x50 (?:?)\n rcu_is_watching+0x20/0x50 (?:?)\n check_prev_add+0xfd/0xd00 (?:?)\n ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)\n __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)\n ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)\n filemap_add_folio+0x105/0x1f0 (?:?)\n ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)\n ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)\n down_write+0xf5/0x180 (?:?)\n ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)\n __mark_inode_dirty+0x758/0x9a0 (?:?)\n inode_to_bdi+0x41/0x90 (?:?)\n balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)\n generic_perform_write+0x252/0x440 (?:?)\n mnt_put_write_access_file+0x16/0x70 (?:?)\n file_update_time_flags+0xe4/0x200 (?:?)\n ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)\n lock_acquire+0x184/0x2f0 (?:?)\n ksys_write+0xd2/0x170 (?:?)\n apparmor_file_permission+0xf5/0x310 (?:?)\n read_zero+0x8d/0x140 (?:?)\n lock_is_held_type+0x8f/0x100 (?:?)","state":0,"publishedAt":"2026-07-19T12:02:04.634+00:00","modifiedAt":"2026-10-19T20:07:47.316+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ocfs2/suballoc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"336340a0f8a141df8a4eb21a5a86f8ffb87769f6\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"296c6a42b1174395935ca4cfe8f393e37b698d54\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"c5a125eadba05ba421c4b55e68da22b4a40d32b4\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"8f9903b0cdbb3155a8899410330b4b4d583a7a5c\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"4cd57ebee395041099fcdfcabb00749ce38d8b27\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"99c21e7263248c3f084756bfae08163cc5d6c62f\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"ccd979bdbce9fba8412beb3f1de68a9d0171b12c\",\n \"lessThan\": \"9bd541e09dffff27e5bec0f9f45b0228173a5375\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"fs/ocfs2/suballoc.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.16\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.16\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.260\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.211\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.177\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.144\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.95\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.38\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1.3\",\n \"lessThanOrEqual\": \"7.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.2\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6","https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54","https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e","https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4","https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c","https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27","https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f","https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-63796","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-63796","identifiers":["CVE-2026-63796"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-08T19:47:20.1649891+00:00","complete":true,"records":1769,"lastAttemptAt":"2026-11-08T19:47:20.1649891+00:00","lastSuccessAt":"2026-11-08T19:47:20.3943637+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.3943658+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-eaa64dac63caa79c8d4905619258c41c51b39e461b996124e1a21b5e85e7e738-5ed072895efd00dfc9298eaa4ea0dc8e51b29da4254bc61a9f28835ec1fa6ea6","complete":true,"records":421260,"lastAttemptAt":"2026-11-08T19:47:19.7023073+00:00","lastSuccessAt":"2026-11-08T19:47:19.6080199+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.7023073+00:00","snapshotPublishedAt":"2026-11-08T19:27:43+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-f1b70ba09149408c9b3f93f80725b8b9","complete":true,"records":13654,"lastAttemptAt":"2026-11-08T19:48:04.0257169+00:00","lastSuccessAt":"2026-11-08T19:48:04.022+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:48:04.022+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13706,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-08T19:47:20.1649891+00:00","complete":true,"records":1096,"lastAttemptAt":"2026-11-08T19:47:20.1649891+00:00","lastSuccessAt":"2026-11-08T19:47:20.3951142+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.3951146+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-3b79c659b4ac42b2801e63ff6ff3a882","complete":false,"records":13666,"lastAttemptAt":"2026-11-08T19:47:46.1695591+00:00","lastSuccessAt":"2026-11-08T19:47:46.166+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:46.166+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13206,"expectedIdentifiers":13706,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-980593e6977a6d1b4fb1eed5a1ffe88a468736f89f0a06f710924ad59132c023","complete":true,"records":9914,"lastAttemptAt":"2026-11-08T19:47:20.0165357+00:00","lastSuccessAt":"2026-11-08T11:07:07.068788+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.0165357+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-fde804134ecdda0ddd5ff5c26ee1fff5a6fa659311f7ef2e51c6ad54964db0e2","complete":true,"records":1971,"lastAttemptAt":"2026-11-08T19:47:19.7560084+00:00","lastSuccessAt":"2026-11-06T19:03:17.0399903+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.7560084+00:00","snapshotPublishedAt":"2026-11-06T18:17:57+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-964c14035e6f0f6478b2870fad6a7ef9f6045876d4a12af2c2e514521e54b6af","complete":true,"records":3055,"lastAttemptAt":"2026-11-08T19:47:20.1181272+00:00","lastSuccessAt":"2026-11-08T11:07:12.1927025+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:20.1181272+00:00","snapshotPublishedAt":"2026-11-08T11:02:46+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-f8647d7ba64b1ba0dfdc7130944766d5b36d5b77d18fff0c79e651a4cff3c2b9","complete":true,"records":231293,"lastAttemptAt":"2026-11-08T19:47:19.9161497+00:00","lastSuccessAt":"2026-11-08T11:06:56.2918717+00:00","error":null,"lastVerifiedAt":"2026-11-08T19:47:19.9161497+00:00","snapshotPublishedAt":"2026-11-08T11:02:50+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}