In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate DIO orphan slot during inode read [BUG] A corrupted append-DIO dinode (high byte at offset 0xa1 corrupted from 0 to 1) can carry an i_dio_orphaned_slot outside the mounted filesystem slot range and trigger a use-after-free error: BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ... ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840 ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline] ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374 ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ... [CAUSE] ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the slot-local system inode cache. The dinode validator does not check this active slot, so an out-of-range value produces an invalid cache entry pointer that is dereferenced as an inode pointer. [FIX] Reject an active i_dio_orphaned_slot outside the slot range during dinode validation, before DIO orphan recovery can consume it.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-151103 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: validate DIO orphan slot during inode read

    [BUG]     A corrupted append-DIO dinode (high byte at offset 0xa1     corrupted from 0 to 1) can carry an i_dio_orphaned_slot     outside the mounted filesystem slot range and trigger a     use-after-free error:

    BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102     Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85     Call Trace:
     ...
     ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102      ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840      ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]      ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295      evict+0x38e/0x8f0 fs/inode.c:810      iput_final fs/inode.c:1914 [inline]      iput fs/inode.c:1966 [inline]      iput+0x55b/0x8b0 fs/inode.c:1926      ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374      ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373      ...

    [CAUSE]     ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the     slot-local system inode cache. The dinode validator does not check     this active slot, so an out-of-range value produces an invalid cache     entry pointer that is dereferenced as an inode pointer.

    [FIX]     Reject an active i_dio_orphaned_slot outside the slot range during     dinode validation, before DIO orphan recovery can consume it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-146675 advisory.

    In the Linux kernel, the following vulnerability has been resolved:

    ocfs2: validate DIO orphan slot during inode read

    [BUG]     A corrupted append-DIO dinode (high byte at offset 0xa1     corrupted from 0 to 1) can carry an i_dio_orphaned_slot     outside the mounted filesystem slot range and trigger a     use-after-free error:

    BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102     Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85     Call Trace:
     ...
     ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102      ocfs2_wipe_inode+0x292/0xf70 fs/ocfs2/inode.c:840      ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline]      ocfs2_evict_inode+0x6c9/0x1170 fs/ocfs2/inode.c:1295      evict+0x38e/0x8f0 fs/inode.c:810      iput_final fs/inode.c:1914 [inline]      iput fs/inode.c:1966 [inline]      iput+0x55b/0x8b0 fs/inode.c:1926      ocfs2_recover_orphans+0x610/0xe40 fs/ocfs2/journal.c:2374      ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373      ...

    [CAUSE]     ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the     slot-local system inode cache. The dinode validator does not check     this active slot, so an out-of-range value produces an invalid cache     entry pointer that is dereferenced as an inode pointer.

    [FIX]     Reject an active i_dio_orphaned_slot outside the slot range during     dinode validation, before DIO orphan recovery can consume it.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ocfs2: validate DIO orphan slot during inode read [BUG] A corrupted append-DIO dinode (high byte at offset     0xa1 corrupted from 0 to 1) can carry an i_dio_orphaned_slot outside the mounted filesystem slot range and     trigger a use-after-free error: BUG: KASAN: slab-use-after-free in ocfs2_get_system_file_inode+0x780/0x820     fs/ocfs2/sysfile.c:102 Read of size 8 at addr ffff88800b767c00 by task kworker/u8:3/85 Call Trace: ...
    ocfs2_get_system_file_inode+0x780/0x820 fs/ocfs2/sysfile.c:102 ocfs2_wipe_inode+0x292/0xf70     fs/ocfs2/inode.c:840 ocfs2_delete_inode fs/ocfs2/inode.c:1155 [inline] ocfs2_evict_inode+0x6c9/0x1170     fs/ocfs2/inode.c:1295 evict+0x38e/0x8f0 fs/inode.c:810 iput_final fs/inode.c:1914 [inline] iput     fs/inode.c:1966 [inline] iput+0x55b/0x8b0 fs/inode.c:1926 ocfs2_recover_orphans+0x610/0xe40     fs/ocfs2/journal.c:2374 ocfs2_complete_recovery+0x5af/0xd00 fs/ocfs2/journal.c:1373 ... [CAUSE]     ocfs2_del_inode_from_orphan() uses i_dio_orphaned_slot to index the slot-local system inode cache. The     dinode validator does not check this active slot, so an out-of-range value produces an invalid cache entry     pointer that is dereferenced as an inode pointer. [FIX] Reject an active i_dio_orphaned_slot outside the     slot range during dinode validation, before DIO orphan recovery can consume it. (CVE-2026-90204)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
378308	Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-151103)	Nessus	Unity Linux Local Security Checks	Local	high
376443	Ubuntu 24.04 LTS / 26.04 LTS : Linux kernel vulnerabilities (USN-8959-1)	Nessus	Ubuntu Local Security Checks	Local	high
373213	Unity Linux 20.1050a Security Update: kernel (UTSA-2026-146675)	Nessus	Unity Linux Local Security Checks	Local	high
347400	Linux Distros Unpatched Vulnerability : CVE-2026-90204	Nessus	Misc.	Local	high

Detections

Analytics

CVE-2026-90204

high

Tenable Plugins

high

high

high

high