What is the CVSS score of CVE-2026-74350?

CVE-2026-74350 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Linux Kernel are affected by CVE-2026-74350?

A critical out-of-bounds memory read in the Linux kernel's ocfs2 filesystem (CVE-2026-74350) can disclose adjacent kernel data when maliciously crafted volumes are mounted and symlinks are read.

How to fix or mitigate CVE-2026-74350?

Within 24 hours: Inventory all systems mounting ocfs2 volumes and document which systems require this filesystem. Within 7 days: Restrict ocfs2 volume mounting to internally-validated sources, disable ocfs2 kernel module support on systems that do not operationally require it, and enable kernel logging to capture mount and symlink access attempts. Within 30 days: Monitor Linux vendor security advisories and deploy kernel patches immediately upon vendor release; establish automated patch management for ocfs2 deployments.

Linux Kernel CVE-2026-74350

EUVD-2026-59497 CRITICAL

2026-08-15 Linux

GHSA-c2hj-4vhc-jh3m

Information Disclosure Linux Red Hat

Critical

Disputed · 9.8 Vendor: Linux

Severity by source

Sources disagree (Medium–Critical)

Vendor (Linux) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

6.1 MEDIUM

Requires mounting a crafted ocfs2 volume (AV:L, PR:L for mount capability); over-read leaks kernel memory (C:H) with possible crash (A:L) and no integrity impact (I:N).

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N

Red Hat

5.5 MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorVendor: Linux

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 17, 2026 - 10:42 vuln.today

CVSS changed

Aug 17, 2026 - 06:22 NVD

9.8 (CRITICAL)

CVE Published

Aug 15, 2026 - 05:58 cve.org

CRITICAL 9.8

CVE Published

Aug 15, 2026 - 05:58 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate fast symlink target during inode read

ocfs2_validate_inode_block() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment.

A zero-cluster symlink is treated as a fast symlink and later read through page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an i_size that does not fit the inline area or omits the terminating NUL at i_size, that copy reads past the end of the inode block buffer.

Reject zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size when the inode block is validated. This keeps malformed fast symlinks from reaching the read path.

Validation reproduced this kernel report: KASAN use-after-free in ocfs2_fast_symlink_read_folio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dump_stack_lvl+0x66/0xa0 (?:?) print_report+0xce/0x630 (?:?) ocfs2_fast_symlink_read_folio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srso_alias_return_thunk+0x5/0xfbef5 (?:?) __virt_addr_valid+0x19f/0x330 (?:?) kasan_report+0xe0/0x110 (?:?) kasan_check_range+0x105/0x1b0 (?:?) __asan_memcpy+0x23/0x60 (?:?) filemap_read_folio+0x27/0xe0 (?:?) filemap_read_folio+0x35/0xe0 (?:?) do_read_cache_folio+0x138/0x230 (?:?) __page_get_link+0x26/0x110 (?:?) page_get_link+0x2e/0x70 (?:?) vfs_readlink+0x15e/0x250 (?:?) touch_atime+0x4d/0x370 (?:?) do_readlinkat+0x186/0x200 (?:?) do_user_addr_fault+0x65a/0x890 (?:?) __x64_sys_readlink+0x46/0x60 (?:?) do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f (?:?)

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel's ocfs2 filesystem allows disclosure of adjacent kernel data when a maliciously crafted or corrupted ocfs2 volume is mounted and a fast symlink is read. ocfs2_validate_inode_block() failed to validate zero-cluster (fast) symlink dinodes, so ocfs2_fast_symlink_read_folio() would strnlen()/memcpy an inline payload whose i_size exceeds the inline area or lacks a terminating NUL, copying past the inode block buffer (KASAN flagged a 3905-byte over-read via readlink). …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Craft malicious ocfs2 image with corrupt fast-symlink dinode

Delivery

Mount volume on target (device/loopback/automount)

Exploit

readlink() reads fast symlink

Execution

Unvalidated i_size drives over-read in ocfs2_fast_symlink_read_folio

Impact

Leak adjacent kernel memory or crash

Access

Craft malicious ocfs2 image with corrupt fast-symlink dinode

Delivery

Mount volume on target (device/loopback/automount)

Exploit

readlink() reads fast symlink

Execution

Unvalidated i_size drives over-read in ocfs2_fast_symlink_read_folio

Impact

Leak adjacent kernel memory or crash

Vulnerability AssessmentAI

Exploitation	Exploitation requires that the system mount an attacker-crafted or corrupted ocfs2 filesystem containing a zero-cluster (fast) symlink dinode whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size, and then that a fast symlink on that volume be read (e.g. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The feed's CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/C:H/I:H/A:H) materially overstates real-world risk and conflicts with the description: this is not a network-reachable, unauthenticated RCE - it is a local, on-disk-metadata bug that requires mounting a crafted or corrupted ocfs2 image, so the true attack vector is Local and privileges to mount are typically needed. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker who can present a filesystem image to a target - e.g. a crafted ocfs2 volume on a USB device, loopback image, or attacker-controlled shared LUN - mounts it (or induces automount) and issues a readlink() on a fast symlink whose dinode has a bogus i_size or missing NUL. …
Remediation	Upstream fix available via stable commits e234973f286ed2e8961a24561ec91594ec3e3ff8 and f9e2cb692b77a679b1f4cc2b7b277fa908586533 (https://git.kernel.org/stable/c/e234973f286ed2e8961a24561ec91594ec3e3ff8 and https://git.kernel.org/stable/c/f9e2cb692b77a679b1f4cc2b7b277fa908586533); update to a kernel containing these - the 7.1.5 stable release or 7.2-rc1 and later - which adds validation of fast-symlink dinodes in ocfs2_validate_inode_block(). … Detailed patch versions, workarounds, and compensating controls in full report.