CVE-2026-72164

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: avoid moving extents to occupied clusters

For non-auto OCFS2_IOC_MOVE_EXT operations, userspace supplies a physical

me_goal. ocfs2_move_extent() initializes new_phys_cpos from that goal and

expects ocfs2_probe_alloc_group() to replace it with a free run in the

target block group.

The probe currently leaves *phys_cpos unchanged if the scan reaches the

end of the group without finding a free run. An occupied goal at the last

bit can therefore survive the probe and be passed to

__ocfs2_move_extent(), which copies file data into a cluster still owned

by another inode before the bitmap is updated.

When the probe does find a free run, it also subtracts move_len from the

ending bit. The start of an N-bit run ending at i is i - N + 1, so the

current calculation can report the bit immediately before the free run.

Clear *phys_cpos before scanning and use the correct free-run start.

Callers already treat a zero result as -ENOSPC, so failed probes no longer

continue with an occupied caller-controlled goal.