CVE-2026-63796

취약점 유형

In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap. Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used. Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x

영향받는 제품

• linux linux_kernel

참고 자료

• https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54
• https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6
• https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27
• https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c
• https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f
• https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375