01 Record

CVE-2026-89493

ocfs2: validate rl_used against rl_count in refcount block validator

HighPUBLISHEDCNA: Linux

CNA base score8.8 CVSS v3.xCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ocfs2: validate rl_used against rl_count in refcount block validator

03 Exploitation and scoring

Exploitation: Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
SSVC decision: Not assessed by CISA
EPSS probability: 0.65% probability of exploitation activity in the next 30 days.
EPSS percentile: Equal to or higher than the score of 51.0% of scored records. A rank, not a probability.
NVD base score: 8.8 (CVSS v3.x), scored by the NVD independently of the CNA.
NVD CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD analysis status: Received. NVD last modified this record on 2026-10-19.
Red Hat severity: Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-09-11 19:43Z1 MO AGO

Last updated

2026-10-19 08:47Z10 DAYS AGO

Reserved

2026-09-11

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.8)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787Out-of-bounds WriteBase

Data version

5.2

Document digest

c300ebf7a46d358a95414490f6aa43fb419eae8ddf2a24489a564dc3a24c5ef3

05 Affected products

VendorProductVersionsPlatforms

LinuxLinuxf2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < f882e9e32d017a6569b2996c63ba3864717788e6, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < 5593b63028cb43a6cda75a65ce1db95f00ea6857, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < c8b02f4ee91e757b3fff556c7168b24b7ae55132, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < 97584e93fc49a2d59252ac60467e9279f11b1b5b, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < af56e90cb546cb0c47bef059335365283f61d6a4, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < 0761d2c9494424469a0d30a9da3496ca010b0b2d, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < 04ead708e13ddcb9c39319cbe02a18cef99cb823, f2c870e3b12e38da6d9b5b17c4c8ae56a0ed68e4 to < 4ca62df6bc0708947b48da3f6a712ecb8e73929c, 2.6.32—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f882e9e32d017a6569b2996c63ba3864717788e6
git.kernel.orghttps://git.kernel.org/stable/c/5593b63028cb43a6cda75a65ce1db95f00ea6857
git.kernel.orghttps://git.kernel.org/stable/c/c8b02f4ee91e757b3fff556c7168b24b7ae55132
git.kernel.orghttps://git.kernel.org/stable/c/97584e93fc49a2d59252ac60467e9279f11b1b5b
git.kernel.orghttps://git.kernel.org/stable/c/af56e90cb546cb0c47bef059335365283f61d6a4
git.kernel.orghttps://git.kernel.org/stable/c/0761d2c9494424469a0d30a9da3496ca010b0b2d
git.kernel.orghttps://git.kernel.org/stable/c/04ead708e13ddcb9c39319cbe02a18cef99cb823
git.kernel.orghttps://git.kernel.org/stable/c/4ca62df6bc0708947b48da3f6a712ecb8e73929c

07 Fixed in

Debian 12

linux
Fixed in 6.1.190-1
linux-6.12
Fixed in 6.12.111-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.111-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.2.6-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.