CVE-2026-74349 (GCVE-0-2026-74349)

Vulnerability from cvelistv5 – Published: 2026-08-15 05:58 – Updated: 2026-08-17 05:46
VLAI
Title
ocfs2: reject FITRIM ranges shorter than a cluster
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->s_blocksize. On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range. Reject ranges shorter than s_clustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < d903d59c0315f59bdf0214b4f13d71c9feb2c45c (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < 441abb77222f155e8d931dbabb465466db01cfd7 (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < e652d0f5108e447b22da4249bcd23dd1b63c73dd (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < 346314bb0cc2fc52b50b73d6ecc62e0217455c2e (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < 06c0a0431b9856506fcd9b2c1b0c6136567d756d (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < 3fa7139b5f42731a61f78c42433adae13f9adc21 (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < 2c13e02592b918be7725ab5965e01ef4e46c4b57 (git)
Affected: aa89762c54800208d5afdcd8e6bf124818f17fe0 , < ca1afd88f5eaaff9168e1466e5401385edf59543 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.14
Unaffected: 0 , < 3.14 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d903d59c0315f59bdf0214b4f13d71c9feb2c45c",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "441abb77222f155e8d931dbabb465466db01cfd7",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "e652d0f5108e447b22da4249bcd23dd1b63c73dd",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "346314bb0cc2fc52b50b73d6ecc62e0217455c2e",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "06c0a0431b9856506fcd9b2c1b0c6136567d756d",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "3fa7139b5f42731a61f78c42433adae13f9adc21",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "2c13e02592b918be7725ab5965e01ef4e46c4b57",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            },
            {
              "lessThan": "ca1afd88f5eaaff9168e1466e5401385edf59543",
              "status": "affected",
              "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/alloc.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.14"
            },
            {
              "lessThan": "3.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject FITRIM ranges shorter than a cluster\n\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb-\u003es_blocksize.\n\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0.  The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\n\nReject ranges shorter than s_clustersize instead.  That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires a local FITRIM ioctl on an open OCFS2 mount (typically via fstrim or ioctl on the mountpoint); there is no network-facing OCFS2 handler or remote protocol path to this code.\nAC:L - An attacker with the required privileges can reliably trigger the bug by supplying a FITRIM range at least one block long but shorter than one cluster, which is common when OCFS2 cluster size exceeds the 4K block size.\nPR:L - The FITRIM handler explicitly requires capable(CAP_SYS_ADMIN) before calling ocfs2_trim_fs(); per kernel CNA guidance this maps to Low because CAP_SYS_ADMIN can be held by root inside a user namespace.\nUI:N - No victim interaction is required; the privileged attacker directly issues the FITRIM ioctl with crafted range parameters to trigger the faulty trim logic.\nS:U - Impact is confined to erroneous discard/trim operations within the same privileged filesystem context on the affected host and shared storage; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The flaw causes incorrect discard of free clusters via sb_issue_discard and integer underflow in range arithmetic; it does not read kernel memory, leak pointers, or expose sensitive data to the attacker.\nI:H - Unsigned underflow can drive trimming far beyond the requested FITRIM range, issuing discard on extensive free-space regions on shared cluster storage and risking unintended loss or corruption of filesystem data integrity.\nA:H - Corrupted len/last_group values can cause prolonged iteration through cluster groups while holding the exclusive OCFS2 cluster-wide trim DLM lock, enabling severe denial of service or hang for the node and other cluster members."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T05:46:12.774Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c"
        },
        {
          "url": "https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd"
        },
        {
          "url": "https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e"
        },
        {
          "url": "https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d"
        },
        {
          "url": "https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21"
        },
        {
          "url": "https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543"
        }
      ],
      "title": "ocfs2: reject FITRIM ranges shorter than a cluster",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74349",
    "datePublished": "2026-08-15T05:58:36.630Z",
    "dateReserved": "2026-08-15T05:44:03.886Z",
    "dateUpdated": "2026-08-17T05:46:12.774Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74349",
      "date": "2026-09-20",
      "epss": "0.00126",
      "percentile": "0.02643"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/alloc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "d903d59c0315f59bdf0214b4f13d71c9feb2c45c",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "441abb77222f155e8d931dbabb465466db01cfd7",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e652d0f5108e447b22da4249bcd23dd1b63c73dd",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "346314bb0cc2fc52b50b73d6ecc62e0217455c2e",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "06c0a0431b9856506fcd9b2c1b0c6136567d756d",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3fa7139b5f42731a61f78c42433adae13f9adc21",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2c13e02592b918be7725ab5965e01ef4e46c4b57",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ca1afd88f5eaaff9168e1466e5401385edf59543",
                    "status": "affected",
                    "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/alloc.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.14"
                  },
                  {
                    "lessThan": "3.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject FITRIM ranges shorter than a cluster\n\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb-\u003es_blocksize.\n\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0.  The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\n\nReject ranges shorter than s_clustersize instead.  That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk."
          }
        ],
        "id": "CVE-2026-74349",
        "lastModified": "2026-08-17T06:19:29.533",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "NONE",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-08-15T06:22:36.130",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-20T20:53:03+00:00",
      "cve": "CVE-2026-74349",
      "id": "CVE-2026-74349",
      "initial_release_date": "2026-08-15T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: reject FITRIM ranges shorter than a cluster",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74349.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:22:25Z",
      "cve": "CVE-2026-74349",
      "id": "CVE-2026-74349",
      "initial_release_date": "2026-09-03T00:07:02Z",
      "product_status:known_affected": "358",
      "product_status:known_not_affected": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74349",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74349.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.