CVE-2026-74350 Linux CVE debrief

Who should care

Defenders responsible for Linux kernel security, particularly those using the ocfs2 filesystem, should be aware of this vulnerability and prioritize verifying and applying patches.

Why it matters

A vulnerability in the Linux kernel's ocfs2 filesystem can cause a use-after-free error when reading symlink targets. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability.

• Verify Linux kernel versions and apply patches to prevent use-after-free errors
• Monitor Linux kernel updates and apply patches as necessary to prevent exploitation
• Review and update Linux kernel versions to ensure they are running a fixed version

Technical summary

The Linux kernel's ocfs2 filesystem has a vulnerability that occurs when validating fast symlink targets during inode reads. The vulnerability can cause a use-after-free error when reading the symlink target. The fix involves rejecting zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size. Affected product deployments should be verified, and patches should be applied to prevent use-after-free errors. Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using the ocfs2 filesystem. The vulnerability was reported through a KASAN use-after-

Defensive priority

Defenders should prioritize verifying and applying patches for Linux kernel versions affected by this vulnerability, particularly those using the ocfs2 filesystem.

Recommended defensive actions

• Verify and apply patches for Linux kernel versions affected by this vulnerability
• Review and update Linux kernel versions to ensure they are running a fixed version
• Monitor Linux kernel updates and apply patches as necessary
• Perform a thorough review of system configurations and apply necessary changes
• Ensure that all necessary security updates are applied and up-to-date
• Verify that all affected systems are properly patched and monitored
• Conduct regular security audits to identify potential vulnerabilities

Evidence notes

The vulnerability was reported through a KASAN use-after-free error in ocfs2_fast_symlink_read_folio(). The error occurs when reading past the end of the inode block buffer due to a corrupt dinode. The fix involves rejecting zero-cluster symlink dinodes whose i_size exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at i_size.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.