CVE-2026-74349ocfs2: reject FITRIM ranges shorter than a cluster
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->s_blocksize. On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range. Reject ranges shorter than s_clustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk.
- CVSS
- 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Received
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from aa89762c54800208d5afdcd8e6bf124818f17fe0 before d903d59c0315f59bdf0214b4f13d71c9feb2c45c; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before 441abb77222f155e8d931dbabb465466db01cfd7; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before e652d0f5108e447b22da4249bcd23dd1b63c73dd; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before 346314bb0cc2fc52b50b73d6ecc62e0217455c2e; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before 06c0a0431b9856506fcd9b2c1b0c6136567d756d; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before 3fa7139b5f42731a61f78c42433adae13f9adc21; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before 2c13e02592b918be7725ab5965e01ef4e46c4b57; from aa89762c54800208d5afdcd8e6bf124818f17fe0 before ca1afd88f5eaaff9168e1466e5401385edf59543 | CNA record |
References
- https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c
- https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7
- https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd
- https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e
- https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d
- https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21
- https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57
- https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.