CVE-2026-63796
ocfs2: reject oversized group bitmap descriptors
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap. Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used. Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_add_and_move+0x1f5/0x3d0 (?:?) ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemap_add_folio+0x105/0x1f0 (?:?) ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?) down_write+0xf5/0x180 (?:?) ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?) __mark_inode_dirty+0x758/0x9a0 (?:?) inode_to_bdi+0x41/0x90 (?:?) balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?) generic_perform_write+0x252/0x440 (?:?) mnt_put_write_access_file+0x16/0x70 (?:?) file_update_time_flags+0xe4/0x200 (?:?) ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lock_acquire+0x184/0x2f0 (?:?) ksys_write+0xd2/0x170 (?:?) apparmor_file_permission+0xf5/0x310 (?:?) read_zero+0x8d/0x140 (?:?) lock_is_held_type+0x8f/0x100 (?:?)
INFO
Published Date :
July 19, 2026, 12:16 p.m.
Last Modified :
Aug. 17, 2026, 5:17 a.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest version.
- Apply security patches for ocfs2.
- Validate descriptor size and bits against capacity.
- Ensure both on-disk and metadata agree.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-63796.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-63796 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-63796
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-63796 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-63796 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 17, 2026
Action Type Old Value New Value Changed Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '336340a0f8a141df8a4eb21a5a86f8ffb87769f6', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '296c6a42b1174395935ca4cfe8f393e37b698d54', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'd2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'c5a125eadba05ba421c4b55e68da22b4a40d32b4', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '8f9903b0cdbb3155a8899410330b4b4d583a7a5c', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '4cd57ebee395041099fcdfcabb00749ce38d8b27', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '99c21e7263248c3f084756bfae08163cc5d6c62f', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '9bd541e09dffff27e5bec0f9f45b0228173a5375', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'affected'}] [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '336340a0f8a141df8a4eb21a5a86f8ffb87769f6', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '296c6a42b1174395935ca4cfe8f393e37b698d54', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'd2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'c5a125eadba05ba421c4b55e68da22b4a40d32b4', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '8f9903b0cdbb3155a8899410330b4b4d583a7a5c', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '4cd57ebee395041099fcdfcabb00749ce38d8b27', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '99c21e7263248c3f084756bfae08163cc5d6c62f', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '9bd541e09dffff27e5bec0f9f45b0228173a5375', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'affected'}] -
Initial Analysis by [email protected]
Jul. 30, 2026
Action Type Old Value New Value Added CWE CWE-125 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.177 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.144 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.95 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.211 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.38 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.1.3 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.16 up to (excluding) 5.10.260 Added Reference Type kernel.org: https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 20, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jul. 19, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '336340a0f8a141df8a4eb21a5a86f8ffb87769f6', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '296c6a42b1174395935ca4cfe8f393e37b698d54', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'd2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': 'c5a125eadba05ba421c4b55e68da22b4a40d32b4', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '8f9903b0cdbb3155a8899410330b4b4d583a7a5c', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '4cd57ebee395041099fcdfcabb00749ce38d8b27', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '99c21e7263248c3f084756bfae08163cc5d6c62f', 'versionType': 'git'}, {'status': 'affected', 'version': 'ccd979bdbce9fba8412beb3f1de68a9d0171b12c', 'lessThan': '9bd541e09dffff27e5bec0f9f45b0228173a5375', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.16'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.16', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.260', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.211', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.177', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.144', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.95', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.38', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.3', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2-rc1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/suballoc.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject oversized group bitmap descriptors ocfs2_validate_gd_parent() only bounds bg_bits against the parent allocator's chain geometry. A malicious descriptor can still claim a bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in the group descriptor block, so later bitmap scans and bit updates can run past bg_bitmap. Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent allocator type and reject descriptors whose bg_size or bg_bits exceed that capacity. Keep the existing chain geometry check so both the on-disk bitmap layout and the allocator metadata must agree before the descriptor is used. Validation reproduced this kernel report: KASAN use-after-free in _find_next_bit+0x7f/0xc0 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xd0/0x630 (?:?) _find_next_bit+0x7f/0xc0 (?:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x188/0x2f0 (?:?) kasan_report+0xe4/0x120 (?:?) ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375) ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457) ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86) ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786) ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886) get_page_from_freelist+0x70e/0x2370 (?:?) lock_release+0xc6/0x290 (?:?) do_raw_spin_unlock+0x9a/0x100 (?:?) kasan_unpoison+0x27/0x60 (?:?) __bfs+0x147/0x240 (?:?) get_page_from_freelist+0x83d/0x2370 (?:?) ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96) sched_domains_numa_masks_clear+0x70/0xd0 (?:?) check_irq_usage+0xe8/0xb70 (?:?) __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497) check_path+0x24/0x50 (?:?) rcu_is_watching+0x20/0x50 (?:?) check_prev_add+0xfd/0xd00 (?:?) ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?) __folio_batch_add_and_move+0x1f5/0x3d0 (?:?) ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?) filemap_add_folio+0x105/0x1f0 (?:?) ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043) ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?) down_write+0xf5/0x180 (?:?) ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?) __mark_inode_dirty+0x758/0x9a0 (?:?) inode_to_bdi+0x41/0x90 (?:?) balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?) generic_perform_write+0x252/0x440 (?:?) mnt_put_write_access_file+0x16/0x70 (?:?) file_update_time_flags+0xe4/0x200 (?:?) ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?) lock_acquire+0x184/0x2f0 (?:?) ksys_write+0xd2/0x170 (?:?) apparmor_file_permission+0xf5/0x310 (?:?) read_zero+0x8d/0x140 (?:?) lock_is_held_type+0x8f/0x100 (?:?) Added Reference https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54 Added Reference https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6 Added Reference https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27 Added Reference https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c Added Reference https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f Added Reference https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375 Added Reference https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4 Added Reference https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e