Strix
57K

CVE-2026-72161

UnknownEPSS 0.21%

Last modified

CVE-2026-72161 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). EPSS estimates a 0.21% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint.

Metrics

EPSS Probability
0.21%

10.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 24daf13422e8328fd588c34a017bdef1949910e8; >= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 7da7e4ac21895fe34cceffcfc99497cc2750da99; >= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < eb6a13834c23e291f1170cb1b489ec255edfa5a3; >= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 499714de42ab4d2e778cbb10186684142a1222eb; >= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < 63921f790234b221e4b15c56c72888b13250f81d; >= da5e7c87827e8caa6a1eeec6d95dcf74ab592a01, < a291c77c034b7a81849ce9b71cc9ecda9e587d89
LinuxLinux5.16

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-72161?
In the Linux kernel, the following vulnerability has been resolved: ocfs2: add journal NULL check in ocfs2_checkpoint_inode() During unmount, ocfs2_journal_shutdown() frees the journal and sets osb->journal to NULL. Later, when VFS evicts remaining cached inodes, ocfs2_evict_inode() -> ocfs2_clear_inode() -> ocfs2_checkpoint_inode() -> ocfs2_ci_fully_checkpointed() dereferences osb->journal, causing a NULL pointer dereference. Fix this by adding a NULL check for osb->journal in ocfs2_checkpoint_inode(). If the journal is NULL, it has already been fully flushed and destroyed during shutdown, so there is nothing to checkpoint.
How severe is CVE-2026-72161?
Severity scoring for CVE-2026-72161 is pending analysis. The EPSS model estimates a 0.21% probability of exploitation in the next 30 days.
How do I fix CVE-2026-72161?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-72161?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST