CVE-2026-72162

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: fix UBSAN array-index-out-of-bounds in ocfs2_sum_rightmost_rec

[BUG]

On-disk corruption setting l_next_free_rec to 0 in an inode's embedded

extent list triggers a UBSAN panic on the next write to that file.

[CAUSE]

ocfs2_sum_rightmost_rec() computes

i = le16_to_cpu(el->l_next_free_rec) - 1

and accesses el->l_recs[i] without validating i. When l_next_free_rec

is 0, i becomes -1; when l_next_free_rec exceeds l_count, i falls

past the end of the array. Either case violates the

__counted_by_le(l_count) annotation on l_recs[] and triggers UBSAN.

[FIX]

Validate the inode's embedded extent list when the inode is read, in

ocfs2_validate_inode_block(): l_count must be non-zero and no larger

than the inode block can hold, and l_next_free_rec must not exceed

l_count. A corrupt list is rejected at read time, before the b-tree

code can index l_recs[] out of bounds.