---
id: CVE-2026-72164
title: 'ocfs2: avoid moving extents to occupied clusters'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: avoid moving extents to occupied clusters

  For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical
  me_goal.  ocfs2_move_extent() initializes ne…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    3112afebf2a76e522fbaabcbb0c47aafbdc35932
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    35486b291b8fbde6c4d0b1c79e565c6260d3329d
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    19f7b04924b20b81dabbeed19d5542792ba5b6d6
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    e281d892ce5870a50fdc718cb3bfc3dd5b62c728
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    d5d5a21fb33cd9b963aea99da81e4dacd452cd95
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    4d1953d3aeb4a7f6623083e1839068ee1c157db2
  - >-
    Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 <
    22920541c35a9f23f219038ba5874c843a7c4419
  - Linux 3.0
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T18:43:10.262778Z'
published: '2026-08-15'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T18:44:59.778Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-72164'
references:
  - url: 'https://git.kernel.org/stable/c/3112afebf2a76e522fbaabcbb0c47aafbdc35932'
  - url: 'https://git.kernel.org/stable/c/35486b291b8fbde6c4d0b1c79e565c6260d3329d'
  - url: 'https://git.kernel.org/stable/c/19f7b04924b20b81dabbeed19d5542792ba5b6d6'
  - url: 'https://git.kernel.org/stable/c/e281d892ce5870a50fdc718cb3bfc3dd5b62c728'
  - url: 'https://git.kernel.org/stable/c/0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e'
  - url: 'https://git.kernel.org/stable/c/d5d5a21fb33cd9b963aea99da81e4dacd452cd95'
  - url: 'https://git.kernel.org/stable/c/4d1953d3aeb4a7f6623083e1839068ee1c157db2'
  - url: 'https://git.kernel.org/stable/c/22920541c35a9f23f219038ba5874c843a7c4419'
tags:
  - cve.org
epss: 0.00169
epssPercentile: 0.05788
ingestedAt: '2026-10-16T19:46:24.426Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: avoid moving extents to occupied clusters

For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical
me_goal.  ocfs2_move_extent() initializes new_phys_cpos from that goal and
expects ocfs2_probe_alloc_group() to replace it with a free run in the
target block group.

The probe currently leaves *phys_cpos unchanged if the scan reaches the
end of the group without finding a free run.  An occupied goal at the last
bit can therefore survive the probe and be passed to
__ocfs2_move_extent(), which copies file data into a cluster still owned
by another inode before the bitmap is updated.

When the probe does find a free run, it also subtracts move_len from the
ending bit.  The start of an N-bit run ending at i is i - N + 1, so the
current calculation can report the bit immediately before the free run.

Clear *phys_cpos before scanning and use the correct free-run start. 
Callers already treat a zero result as -ENOSPC, so failed probes no longer
continue with an occupied caller-controlled goal.

## Affected

- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 3112afebf2a76e522fbaabcbb0c47aafbdc35932`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 35486b291b8fbde6c4d0b1c79e565c6260d3329d`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 19f7b04924b20b81dabbeed19d5542792ba5b6d6`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < e281d892ce5870a50fdc718cb3bfc3dd5b62c728`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 0d0c5c17b18bdbc592ac26ab4d1de7e3dbf9be1e`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < d5d5a21fb33cd9b963aea99da81e4dacd452cd95`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 4d1953d3aeb4a7f6623083e1839068ee1c157db2`
- `Linux >= e6b5859cccfa0fec02f3c5b1069481efc7186f47 < 22920541c35a9f23f219038ba5874c843a7c4419`
- `Linux 3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.