---
id: CVE-2026-89492
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: validate directory-index entry counts when reading metadata

  ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
  signature of an indexed-dire…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: validate directory-index entry counts when reading metadata

  ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
  signature of an indexed-dire…
severity: critical
cvss: 9.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-125
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 9b7895efac906d66d19856194e1ba61f37e231a4 <
    5e661f55ca8568471fce558effe81cca112f5cb2
  - >-
    Linux >= 9b7895efac906d66d19856194e1ba61f37e231a4 <
    fcfcba8fe17dbf2c8805690b8cc25e32d81249a4
  - >-
    Linux >= 9b7895efac906d66d19856194e1ba61f37e231a4 <
    b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed
  - >-
    Linux >= 9b7895efac906d66d19856194e1ba61f37e231a4 <
    bc70726ddad53c7e9a9a85915bf2415b0d4f42f9
  - Linux 2.6.30
published: '2026-09-11'
updated: '2026-09-21'
sourceUpdated: '2026-09-21T14:17:22.547'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89492'
references:
  - url: 'https://git.kernel.org/stable/c/5e661f55ca8568471fce558effe81cca112f5cb2'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b8a5c0c32df2c5b685ceef76ac77e37c7e1dc3ed'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/bc70726ddad53c7e9a9a85915bf2415b0d4f42f9'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/fcfcba8fe17dbf2c8805690b8cc25e32d81249a4'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89492.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89492'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532489'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89492'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89492'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89492.mbox
tags:
  - nvd
  - cve.org
  - csaf
  - vex
  - red-hat
  - score-dispute
epss: 0.00605
epssPercentile: 0.47356
scores:
  nvd: 9.8
  cna: 9.8
  vendor: 5.5
ingestedAt: '2026-09-14T15:23:07.475Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate directory-index entry counts when reading metadata

ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() check the ECC and
signature of an indexed-directory block before it reaches higher-level
callers, but neither validator bounds the ocfs2_dx_entry_list counts
against the capacity of the block that holds them.

ocfs2_dx_dir_search() then walks

	for (i = 0; i < le16_to_cpu(entry_list->de_num_used); i++)
		dx_entry = &entry_list->de_entries[i];

over de_num_used entries with no bounds check.  entry_list is either
dx_leaf->dl_list (from ocfs2_read_dx_leaf) or, for an inline root,
dx_root->dr_entries.  A crafted on-disk image can set de_num_used (and
de_count, which is the __counted_by_le() bound of de_entries) to 0xffff
and make the walk read far past the end of the 4KB metadata block, giving
a slab out-of-bounds read reachable from any path lookup, stat() or open()
on an indexed directory once the image is mounted.

Commit 775c17386a6f ("ocfs2: validate dx_root extent list fields during
block read") already bounds dr_list for the non-inline dx_root, but left
the inline dr_entries path and the dx_leaf dl_list unchecked.  Add the
same read-time validation for both entry lists: de_count must equal the
capacity of the block (ocfs2_dx_entries_per_leaf()/per_root()) and
de_num_used must not exceed de_count, rejecting corrupted metadata with
-EFSCORRUPTED before ocfs2_dx_dir_search() can walk an out-of-range entry
array.

de_count is always written as exactly the block capacity when a leaf or
inline root is formatted, so the equality check does not reject any valid
image.

Found by 0sec automated security-research tooling (https://0sec.ai).

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89492.json)