ocfs2: fix readdir position truncation on 32-bit kernels
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Partial Red Hat: 1 without a fix
No CVSS vector from any source. Fix status from CNA and Red Hat.
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix readdir position truncation on 32-bit kernels In ocfs2_dir_foreach_blk_el(), the directory cookie position is rebuilt with ctx->pos = (ctx->pos & ~(sb->s_blocksize - 1)) | offset; `ctx->pos` is loff_t (signed 64-bit), while `sb->s_blocksize` is unsigned long. On 32-bit kernels unsigned long is 32-bit, so the mask ~(sb->s_blocksize - 1) is computed as a 32-bit unsigned value (e.g. 0xfffff000 for a 4 KiB block size). In the AND expression with the 64-bit `ctx->pos`, that unsigned operand is zero-extended to 64 bits per the usual arithmetic conversions, yielding 0x00000000fffff000. The high 32 bits of `ctx->pos` are silently cleared, even though directory size is allowed to exceed 4 GiB. When readdir() crosses the 4 GiB boundary on a 32-bit kernel the position is reset back into the first 4 GiB block, making the re-validation path re-enumerate already-returned dirents indefinitely. This is ocfs2_dir_foreach_blk_el(), the extent-list readdir path taken for all non-inline directories, so a directory large enough to cross 4 GiB reaches it. This is the same class of bug that commit 3dce5bb82c97 ("exfat: Fix bitwise operation having different size") fixed in exfat, and the fix mirrors the equivalent ext4 fix in this series. Cast the operand to loff_t so the mask is 64-bit before the AND: ctx->pos = (ctx->pos & ~((loff_t)sb->s_blocksize - 1)) | offset; 64-bit kernels are unaffected.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Linux | Linux | 2.6.16 and later | 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3 | Patch available | CNA |
- Linux VendorLinux Affected 2.6.16 and later Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3 Patch available CNA
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, 6.18.50, 7.2.4, 7.3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
Timeline
- 2026-10-02 Threatist record created from CVE-2026-89490
- 2026-10-03 Alias added: GHSA-3jg7-r7pg-8654
- 2026-10-19 Fix available: Linux/[email protected] · CNA
References
Other 8
- https://git.kernel.org/stable/c/c28dc3407937aa8f225942538cd585c9b28ea65a
- https://git.kernel.org/stable/c/94569154ba49f5f85645d2019c8e206213d8404e
- https://git.kernel.org/stable/c/1ae7029823ae4c91664cb32eec7fb8dd5e1a337a
- https://git.kernel.org/stable/c/f9dd5cad8d09110ddff2db1fe756aae93c7552ff
- https://git.kernel.org/stable/c/1001fb3b69a11eaa0dc7c7428f6edfa48b88997a
- https://git.kernel.org/stable/c/c0c165487a2ea5a37ddcdab4259157b7a527129c
- https://git.kernel.org/stable/c/b53e2b271eeb6040c2a4a78230c570dc41cdcfa4
- https://git.kernel.org/stable/c/a63308ab426f3a3c7e33b02c150ea59054620261
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-89490 · CVE Program
- CVE-2026-89490 · NVD
- FIRST EPSS
- GHSA-3jg7-r7pg-8654 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-89490 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences