The Linux kernel's ocfs2 filesystem had a vulnerability where the functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() validated ECC and signatures of indexed-directory blocks but did not bound the ocfs2_dx_entry_list counts against the block capacity. Consequently, ocfs2_dx_dir_search() iterated over de_num_used entries without bounds checking, allowing a crafted on-disk image to set de_num_used to 0xffff and cause out-of-bounds reads beyond the 4KB metadata block. This vulnerability was fixed by adding validation that de_count equals the block capacity and de_num_used does not exceed de_count, rejecting corrupted metadata with an error before unsafe access.

This vulnerability allows an attacker with the ability to mount a crafted ocfs2 filesystem image to cause out-of-bounds reads in kernel memory during directory operations such as path lookup, stat(), or open(). While no direct exploit code or active exploitation is reported, such out-of-bounds reads can lead to information disclosure or kernel instability.

A fix has been implemented in the Linux kernel to validate directory-index entry counts and reject corrupted metadata before unsafe reads occur. Users should apply the official kernel updates that include this patch. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended mitigation.