SB20260912301 - Incorrect Conversion between Numeric Types in Linux kernel ocfs2

Description

This security bulletin contains information about 1 vulnerability.

1) Incorrect Conversion between Numeric Types (CVE-ID: CVE-2026-89490)

CWE-ID: CWE-681 - Incorrect Conversion between Numeric Types

CVSSv4: 2 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a local user to cause a denial of service by triggering indefinite directory re-enumeration.

The vulnerability exists due to an incorrect integer conversion in ocfs2_dir_foreach_blk_el() when reading a non-inline directory that crosses the 4 GiB boundary on a 32-bit kernel. A local user can invoke readdir() on an affected directory to cause a denial of service by triggering indefinite directory re-enumeration.

64-bit kernels are unaffected.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1001fb3b69a11eaa0dc7c7428f6edfa48b88997a
• https://git.kernel.org/stable/c/a63308ab426f3a3c7e33b02c150ea59054620261
• https://git.kernel.org/stable/c/b53e2b271eeb6040c2a4a78230c570dc41cdcfa4
• https://git.kernel.org/stable/c/c0c165487a2ea5a37ddcdab4259157b7a527129c