{"apiVersion":"1.0","identifier":"CVE-2026-72159","description":"In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject non-inline dinodes with i_size and zero i_clusters On a volume mounted without OCFS2_FEATURE_INCOMPAT_SPARSE_ALLOC, a non-inline regular file with non-zero i_size and zero i_clusters is structurally malformed: the extent map declares no allocated clusters yet the size header claims content exists. Keep rejecting that shape, but express it through a shared predicate so the same invariant is available to normal inode reads and online filecheck. The same zero-cluster shape is also malformed for non-inline directories. ocfs2 directory growth allocates backing storage before advancing i_size, and ocfs2_dir_foreach_blk_el() later walks until ctx->pos reaches i_size_read(inode). A forged directory dinode with a huge i_size and no clusters would repeatedly fail on holes while advancing through the claimed size. Sparse regular files remain exempt: on sparse-alloc volumes, truncate can legitimately grow i_size without allocating clusters. System inodes and inline-data dinodes also retain their separate storage rules. Mirror the check in ocfs2_filecheck_validate_inode_block() as well. filecheck reports through its own error namespace, so malformed size/cluster state is logged as a filecheck invalid-inode result rather than via ocfs2_error(), but it must not proceed into ocfs2_populate_inode().","publishedAt":"2026-08-15T06:21:33","lastModifiedAt":"2026-08-17T06:18:16","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72159","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00211,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72159","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72159","en":"https://www.redsauce.net/en/cves/CVE-2026-72159","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72159","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72159","de":"https://www.redsauce.net/de/cves/CVE-2026-72159","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72159","el":"https://www.redsauce.net/el/cves/CVE-2026-72159"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72159"}}