The Linux kernel's ocfs2 filesystem had a vulnerability where the refcount block validator did not verify that rl_used was less than or equal to rl_count, nor that rl_count matched the fixed capacity of refcount records per block. This allowed a crafted refcount block with an excessively large rl_used value (e.g., 0xffff) to cause out-of-bounds array access and a subsequent out-of-bounds memmove operation. The flaw could be exploited locally by a user with CAP_SYS_ADMIN mounting a malicious or corrupted ocfs2 filesystem image or by raw writes to the block device. The fix added checks in ocfs2_validate_refcount_block() to ensure rl_count matches the expected capacity and rl_used does not exceed rl_count, preventing out-of-bounds memory operations.

The vulnerability enables out-of-bounds memory reads and writes within the ocfs2 filesystem code, potentially leading to kernel memory corruption or crashes. Exploitation requires local administrative privileges (CAP_SYS_ADMIN) and the ability to mount a crafted or corrupted ocfs2 filesystem image or perform raw writes to the underlying block device. There is no indication of remote exploitation or widespread active exploitation in the wild.

A fix has been implemented in the Linux kernel to add validation checks in ocfs2_validate_refcount_block() that reject malformed refcount blocks with invalid rl_used or rl_count values. Users should update to a Linux kernel version that includes this patch. No additional mitigation is required if running a patched kernel.