In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject oversized group bitmap descriptors

ocfs2_validate_gd_parent() only bounds bg_bits against the parent
allocator's chain geometry.  A malicious descriptor can still claim a
bg_size/bg_bits pair that exceeds the bitmap bytes that physically fit in
the group descriptor block, so later bitmap scans and bit updates can run
past bg_bitmap.

Add a physical-cap check based on ocfs2_group_bitmap_size() for the parent
allocator type and reject descriptors whose bg_size or bg_bits exceed that
capacity.  Keep the existing chain geometry check so both the on-disk
bitmap layout and the allocator metadata must agree before the descriptor
is used.

Validation reproduced this kernel report:
KASAN use-after-free in _find_next_bit+0x7f/0xc0
Read of size 8
Call trace:
  dump_stack_lvl+0x66/0xa0 (?:?)
  print_report+0xd0/0x630 (?:?)
  _find_next_bit+0x7f/0xc0 (?:?)
  srso_alias_return_thunk+0x5/0xfbef5 (?:?)
  __virt_addr_valid+0x188/0x2f0 (?:?)
  kasan_report+0xe4/0x120 (?:?)
  ocfs2_find_max_contig_free_bits+0x35/0x70 (fs/ocfs2/suballoc.c:1375)
  ocfs2_block_group_set_bits+0x472/0x4b0 (fs/ocfs2/suballoc.c:1457)
  ocfs2_cluster_group_search+0x16b/0x440 (fs/ocfs2/suballoc.c:86)
  ocfs2_bg_discontig_fix_result+0x1ef/0x230 (fs/ocfs2/suballoc.c:1786)
  ocfs2_search_chain+0x8f8/0x10a0 (fs/ocfs2/suballoc.c:1886)
  get_page_from_freelist+0x70e/0x2370 (?:?)
  lock_release+0xc6/0x290 (?:?)
  do_raw_spin_unlock+0x9a/0x100 (?:?)
  kasan_unpoison+0x27/0x60 (?:?)
  __bfs+0x147/0x240 (?:?)
  get_page_from_freelist+0x83d/0x2370 (?:?)
  ocfs2_claim_suballoc_bits+0x38c/0xe70 (fs/ocfs2/suballoc.c:96)
  sched_domains_numa_masks_clear+0x70/0xd0 (?:?)
  check_irq_usage+0xe8/0xb70 (?:?)
  __ocfs2_claim_clusters+0x18d/0x4c0 (fs/ocfs2/suballoc.c:2497)
  check_path+0x24/0x50 (?:?)
  rcu_is_watching+0x20/0x50 (?:?)
  check_prev_add+0xfd/0xd00 (?:?)
  ocfs2_add_clusters_in_btree+0x17d/0x810 (fs/ocfs2/suballoc.c:?)
  __folio_batch_add_and_move+0x1f5/0x3d0 (?:?)
  ocfs2_add_inode_data+0xd9/0x120 (fs/ocfs2/suballoc.c:?)
  filemap_add_folio+0x105/0x1f0 (?:?)
  ocfs2_write_begin_nolock+0x29f7/0x2f80 (fs/ocfs2/suballoc.c:3043)
  ocfs2_read_inode_block+0xb5/0x110 (fs/ocfs2/suballoc.c:?)
  down_write+0xf5/0x180 (?:?)
  ocfs2_write_begin+0x180/0x240 (fs/ocfs2/suballoc.c:?)
  __mark_inode_dirty+0x758/0x9a0 (?:?)
  inode_to_bdi+0x41/0x90 (?:?)
  balance_dirty_pages_ratelimited_flags+0xf8/0x1d0 (?:?)
  generic_perform_write+0x252/0x440 (?:?)
  mnt_put_write_access_file+0x16/0x70 (?:?)
  file_update_time_flags+0xe4/0x200 (?:?)
  ocfs2_file_write_iter+0x80a/0x1320 (fs/ocfs2/suballoc.c:?)
  lock_acquire+0x184/0x2f0 (?:?)
  ksys_write+0xd2/0x170 (?:?)
  apparmor_file_permission+0xf5/0x310 (?:?)
  read_zero+0x8d/0x140 (?:?)
  lock_is_held_type+0x8f/0x100 (?:?)

https://git.kernel.org/stable/c/296c6a42b1174395935ca4cfe8f393e37b698d54

https://git.kernel.org/stable/c/336340a0f8a141df8a4eb21a5a86f8ffb87769f6

https://git.kernel.org/stable/c/4cd57ebee395041099fcdfcabb00749ce38d8b27

https://git.kernel.org/stable/c/8f9903b0cdbb3155a8899410330b4b4d583a7a5c

https://git.kernel.org/stable/c/99c21e7263248c3f084756bfae08163cc5d6c62f

https://git.kernel.org/stable/c/9bd541e09dffff27e5bec0f9f45b0228173a5375

https://git.kernel.org/stable/c/c5a125eadba05ba421c4b55e68da22b4a40d32b4

https://git.kernel.org/stable/c/d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["fs/ocfs2/suballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"336340a0f8a141df8a4eb21a5a86f8ffb87769f6","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"296c6a42b1174395935ca4cfe8f393e37b698d54","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"d2cd59fa848f9f13796ef214d3b1b5ca9a3fe21e","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"c5a125eadba05ba421c4b55e68da22b4a40d32b4","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"8f9903b0cdbb3155a8899410330b4b4d583a7a5c","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"4cd57ebee395041099fcdfcabb00749ce38d8b27","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"99c21e7263248c3f084756bfae08163cc5d6c62f","versionType":"git","status":"affected"},{"version":"ccd979bdbce9fba8412beb3f1de68a9d0171b12c","lessThan":"9bd541e09dffff27e5bec0f9f45b0228173a5375","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["fs/ocfs2/suballoc.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"2.6.16","status":"affected"},{"version":"0","lessThan":"2.6.16","versionType":"semver","status":"unaffected"},{"version":"5.10.260","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.211","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.177","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.144","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.95","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.38","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.1.3","lessThanOrEqual":"7.1.*","versionType":"semver","status":"unaffected"},{"version":"7.2-rc1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]