CVE-2026-72159

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject non-inline dinodes with isize and zero iclusters

On a volume mounted without OCFS2FEATUREINCOMPATSPARSEALLOC, a non-inline regular file with non-zero isize and zero iclusters is structurally malformed: the extent map declares no allocated clusters yet the size header claims content exists. Keep rejecting that shape, but express it through a shared predicate so the same invariant is available to normal inode reads and online filecheck.

The same zero-cluster shape is also malformed for non-inline directories. ocfs2 directory growth allocates backing storage before advancing isize, and ocfs2dirforeachblkel() later walks until ctx->pos reaches isizeread(inode). A forged directory dinode with a huge isize and no clusters would repeatedly fail on holes while advancing through the claimed size.

Sparse regular files remain exempt: on sparse-alloc volumes, truncate can legitimately grow i_size without allocating clusters. System inodes and inline-data dinodes also retain their separate storage rules.

Mirror the check in ocfs2filecheckvalidateinodeblock() as well. filecheck reports through its own error namespace, so malformed size/cluster state is logged as a filecheck invalid-inode result rather than via ocfs2error(), but it must not proceed into ocfs2populate_inode().