dbcve.org
Linux KernelOperating system · Linux

CVE-2026-53040

HIGH · 7.1 CVSS v3.1 Published 2026-06-24
Fix available
A fix is available. Upgrade to 5.10.258 / 5.15.209 or later.
See remediation →
73/100
Remediation priority · Elevated
Zero-click 8 weeks old

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate bg_bits during freefrag scan [BUG] A crafted filesystem can trigger an out-of-bounds bitmap walk when OCFS2_IOC_INFO is issued with OCFS2_INFO_FL_NON_COHERENT. BUG: KASAN: use-after-free in instrument_atomic_read include/linux/instrumented.h:68 [inline] BUG: KASAN: use-after-free in _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] BUG: KASAN: use-after-free in test_bit_le include/asm-generic/bitops/le.h:21 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] BUG: KASAN: use-after-free in ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] BUG: KASAN: use-after-free in ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 Read of size 8 at addr ffff888031bce000 by task syz.0.636/1435 Call Trace: __dump_stack lib/dump_stack.c:94 [inline] dump_stack_lvl+0xbe/0x130 lib/dump_stack.c:120 print_address_description mm/kasan/report.c:378 [inline] print_report+0xd1/0x650 mm/kasan/report.c:482 kasan_report+0xfb/0x140 mm/kasan/report.c:595 check_region_inline mm/kasan/generic.c:186 [inline] kasan_check_range+0x11c/0x200 mm/kasan/generic.c:200 __kasan_check_read+0x11/0x20 mm/kasan/shadow.c:31 instrument_atomic_read include/linux/instrumented.h:68 [inline] _test_bit include/asm-generic/bitops/instrumented-non-atomic.h:141 [inline] test_bit_le include/asm-generic/bitops/le.h:21 [inline] ocfs2_info_freefrag_scan_chain fs/ocfs2/ioctl.c:495 [inline] ocfs2_info_freefrag_scan_bitmap fs/ocfs2/ioctl.c:588 [inline] ocfs2_info_handle_freefrag fs/ocfs2/ioctl.c:662 [inline] ocfs2_info_handle_request+0x1c66/0x3370 fs/ocfs2/ioctl.c:754 ocfs2_info_handle+0x18d/0x2a0 fs/ocfs2/ioctl.c:828 ocfs2_ioctl+0x632/0x6e0 fs/ocfs2/ioctl.c:913 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:597 [inline] __se_sys_ioctl fs/ioctl.c:583 [inline] __x64_sys_ioctl+0x197/0x1e0 fs/ioctl.c:583 ... [CAUSE] ocfs2_info_freefrag_scan_chain() uses on-disk bg_bits directly as the bitmap scan limit. The coherent path reads group descriptors through ocfs2_read_group_descriptor(), which validates the descriptor before use. The non-coherent path uses ocfs2_read_blocks_sync() instead and skips that validation, so an impossible bg_bits value can drive the bitmap walk past the end of the block. [FIX] Compute the bitmap capacity from the filesystem format with ocfs2_group_bitmap_size(), report descriptors whose bg_bits exceeds that limit, and clamp the scan to the computed capacity. This keeps the freefrag report going while avoiding reads beyond the buffer.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

A use-after-free vulnerability exists in the ocfs2 filesystem's freefrag scan ioctl handler. The non-coherent path skips validation of the on-disk bg_bits field, allowing a crafted filesystem to drive an out-of-bounds bitmap walk past the end of the buffer. The fix adds validation of bg_bits against the computed bitmap capacity from ocfs2_group_bitmap_size() and clamps the scan to prevent the out-of-bounds access.

MitigationAvoid mounting untrusted ocfs2 filesystems or refrain from using OCFS2_IOC_INFO with OCFS2_INFO_FL_NON_COHERENT until the kernel patch is applied. The vulnerability is triggered by a specially crafted on-disk filesystem image.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
Linux KernelOperating system
Affected:>= 3.0, < 5.10.258>= 5.11, < 5.15.209>= 5.16, < 6.1.175>= 6.2, < 6.6.141>= 6.7, < 6.12.91>= 6.13, < 6.18.33>= 6.19, < 7.0.10

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check your running kernel version
    Run 'uname -r' to get the kernel version, then compare it to the affected ranges: >= 3.0, < 5.10.258; >= 5.11, < 5.15.209; >= 5.16, < 6.1.175; >= 6.2, < 6.6.141; >= 6.7, < 6.12.91; >= 6.13, < 6.18.33; >= 6.19, < 7.0.10
    Affected if The kernel version falls within any of the listed affected ranges
  2. Determine if the ocfs2 kernel module is loaded
    Run 'lsmod | grep ocfs2' or check /proc/modules for ocfs2
    Affected if The ocfs2 module is loaded into memory
  3. Identify mounted ocfs2 filesystems
    Run 'mount -t ocfs2' or check /proc/mounts for ocfs2 type entries
    Affected if Any ocfs2 filesystems are currently mounted (especially from untrusted sources)
  4. Check for ocfs2 ioctl usage patterns
    Audit logs or application code for usage of OCFS2_IOC_INFO ioctl with OCFS2_INFO_FL_NON_COHERENT flag
    Affected if The OCFS2_IOC_INFO ioctl with OCFS2_INFO_FL_NON_COHERENT is being invoked on mounted ocfs2 filesystems

You are affected if your kernel version is in the affected ranges AND you have ocfs2 filesystems mounted (particularly from untrusted sources) AND you use or have used the OCFS2_IOC_INFO ioctl with non-coherent mode.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 5.10.258 / 5.15.209 / 6.1.175 or later
Fixed in 5.10.2585.15.2096.1.175
Interim mitigation

Avoid mounting untrusted ocfs2 filesystems or refrain from using OCFS2_IOC_INFO with OCFS2_INFO_FL_NON_COHERENT until the kernel patch is applied. The vulnerability is triggered by a specially crafted on-disk filesystem image.

Recommended fix High confidence

Upgrade to kernel 6.6.141 (or the latest stable in your current branch: 5.10.258+, 5.15.209+, 6.1.175+, or 6.6.141+)

  1. 1. Identify the currently running Linux kernel version using `uname -r`
  2. 2. Determine which stable kernel series you are running (e.g., 5.10.x, 5.15.x, 6.1.x, 6.2.x, 6.6.x)
  3. 3. If running a kernel < 5.10.258, upgrade to 5.10.258 or later in the 5.10 stable series
  4. 4. If running kernel 5.11 - 5.15.x, upgrade to 5.15.209 or later in the 5.15 stable series
  5. 5. If running kernel 5.16 - 6.1.x, upgrade to 6.1.175 or later in the 6.1 stable series
  6. 6. If running kernel 6.2 - 6.6.x, upgrade to 6.6.141 or later in the 6.6 stable series
  7. 7. If running kernel >= 6.7, verify the fix is included by checking kernel release notes or the ocfs2 ioctl.c file for the validation code
  8. 8. After upgrade, reboot the system to load the fixed kernel
Caveat Kernel upgrades may introduce regressions; ensure compatibility with dependent modules and software before production deployment

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Linux Kernel Scoped from the published advisory
  • Consultation4.0 h
  • Implementation8.0 h
  • Testing12.0 h
  • Review / QA4.0 h
28.0 hours of engineering $4,760
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $7,616.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2026-53040 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2026-53040 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data