Skip to main content

Linux Kernel CVE-2026-74349

| EUVDEUVD-2026-59496 HIGH
2026-08-15 Linux GHSA-xvwx-4pm6-jf3g
Information Disclosure Linux Red Hat
7.1
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
vuln.today AI
7.1 HIGH

Local ioctl requires low privilege; no confidentiality impact; filesystem corruption drives high integrity and availability impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Red Hat
5.5 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 17, 2026 - 10:42 vuln.today
CVSS changed
Aug 17, 2026 - 06:22 NVD
7.1 (HIGH)
Patch available
Aug 15, 2026 - 07:19 EUVD
CVE Published
Aug 15, 2026 - 05:58 cve.org
HIGH 7.1
CVE Published
Aug 15, 2026 - 05:58 cve.org
UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject FITRIM ranges shorter than a cluster

ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->s_blocksize.

On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range.

Reject ranges shorter than s_clustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk.

AnalysisAI

Integer underflow in the ocfs2 filesystem's FITRIM implementation allows a local low-privileged user to corrupt filesystem data or trigger a crash by submitting a trim range shorter than one cluster. The validation in ocfs2_trim_mainbm() checks against sb->s_blocksize instead of s_clustersize; on filesystems where cluster size exceeds block size, a range that passes the block-size check gets shifted to len==0, after which pointer arithmetic involving start + len - 1 and len -= ... …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Recon
Obtain low-privilege local shell on ocfs2 host
Delivery
Identify mount with s_clustersize > s_blocksize
Exploit
Issue FITRIM ioctl with range shorter than cluster size
Install
Bypass erroneous blocksize-only validation
C2
Trigger integer underflow in len arithmetic
Execute
Kernel trims beyond requested range
Impact
Filesystem corruption or kernel panic
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires: (1) a Linux system with an ocfs2 filesystem mounted, (2) the filesystem must be configured with s_clustersize strictly greater than s_blocksize - for example, a cluster size of 8 KB on a filesystem formatted with a 4 KB block size; this is a valid but non-universal ocfs2 configuration, (3) the attacker must hold at least low-privilege local access sufficient to invoke the FITRIM ioctl or execute fstrim against the mounted volume (PR:L per CVSS), and (4) the underlying block device must support DISCARD/TRIM commands for the trim path to execute. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 3.1 score of 7.1 (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) correctly reflects local exploitation with integrity and availability impact, as trimming past requested bounds can overwrite live filesystem allocation metadata and cause kernel panics. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker with a local low-privilege account on a Linux system mounting an ocfs2 volume - where the cluster size is configured larger than the block size - invokes the FITRIM ioctl (or the fstrim utility) with a range argument that is at least one block but shorter than one cluster. The validation check passes erroneously, len underflows to zero, and the kernel proceeds to trim allocation groups well beyond the requested range, corrupting filesystem metadata or triggering a kernel panic. …
Remediation The primary fix is to upgrade to one of the patched stable kernel releases: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1, depending on the distribution's tracked stable branch. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, identify all systems running ocfs2 filesystems and document their business-critical role in data operations. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

Share

CVE-2026-74349 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy