The Linux kernel OCFS2 filesystem trusted active ordinary and append-DIO orphan slots read from dinodes without sufficient validation. A corrupted dinode with the OCFS2_ORPHANED_FL flag could carry an i_orphaned_slot value outside the valid mounted filesystem slot range. This caused ocfs2_wipe_inode() to index osb_orphan_wipes out-of-bounds, leading to a use-after-free memory access detected by KASAN. The root cause was that ocfs2_validate_inode_block() validated i_suballoc_slot but did not check the active ordinary orphan slot. The fix added validation to reject an active i_orphaned_slot outside the slot range during dinode validation, preventing corrupted metadata from reaching orphan wipe processing.

This vulnerability allows out-of-bounds memory access and use-after-free conditions in the OCFS2 filesystem code path, which can lead to kernel crashes or potentially arbitrary code execution with kernel privileges. The CVSS score of 7.8 indicates high severity with impacts on confidentiality, integrity, and availability. Exploitation requires local access and user interaction.

A patch series has been released that validates orphan slots during inode read to reject corrupted metadata before it can cause out-of-bounds access. Users should apply the official Linux kernel updates that include this fix. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. No alternative mitigations are indicated.