CVE-2026-74349

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-74349", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-08-15T05:44:03.886Z", "datePublished": "2026-08-15T05:58:36.630Z", "dateUpdated": "2026-10-16T18:55:34.720Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:12.774Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject FITRIM ranges shorter than a cluster\n\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb->s_blocksize.\n\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0. The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\n\nReject ranges shorter than s_clustersize instead. That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "baseScore": 7.1, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a local FITRIM ioctl on an open OCFS2 mount (typically via fstrim or ioctl on the mountpoint); there is no network-facing OCFS2 handler or remote protocol path to this code.\nAC:L - An attacker with the required privileges can reliably trigger the bug by supplying a FITRIM range at least one block long but shorter than one cluster, which is common when OCFS2 cluster size exceeds the 4K block size.\nPR:L - The FITRIM handler explicitly requires capable(CAP_SYS_ADMIN) before calling ocfs2_trim_fs(); per kernel CNA guidance this maps to Low because CAP_SYS_ADMIN can be held by root inside a user namespace.\nUI:N - No victim interaction is required; the privileged attacker directly issues the FITRIM ioctl with crafted range parameters to trigger the faulty trim logic.\nS:U - Impact is confined to erroneous discard/trim operations within the same privileged filesystem context on the affected host and shared storage; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The flaw causes incorrect discard of free clusters via sb_issue_discard and integer underflow in range arithmetic; it does not read kernel memory, leak pointers, or expose sensitive data to the attacker.\nI:H - Unsigned underflow can drive trimming far beyond the requested FITRIM range, issuing discard on extensive free-space regions on shared cluster storage and risking unintended loss or corruption of filesystem data integrity.\nA:H - Corrupted len/last_group values can cause prolonged iteration through cluster groups while holding the exclusive OCFS2 cluster-wide trim DLM lock, enabling severe denial of service or hang for the node and other cluster members."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/alloc.c"], "versions": [{"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "d903d59c0315f59bdf0214b4f13d71c9feb2c45c", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "441abb77222f155e8d931dbabb465466db01cfd7", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "e652d0f5108e447b22da4249bcd23dd1b63c73dd", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "346314bb0cc2fc52b50b73d6ecc62e0217455c2e", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "06c0a0431b9856506fcd9b2c1b0c6136567d756d", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "3fa7139b5f42731a61f78c42433adae13f9adc21", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "2c13e02592b918be7725ab5965e01ef4e46c4b57", "status": "affected", "versionType": "git"}, {"version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "ca1afd88f5eaaff9168e1466e5401385edf59543", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/ocfs2/alloc.c"], "versions": [{"version": "3.14", "status": "affected"}, {"version": "0", "lessThan": "3.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.261", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.212", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.178", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.145", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.97", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.40", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1.5", "lessThanOrEqual": "7.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.10.261"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "5.15.212"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.1.178"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.6.145"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.12.97"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "6.18.40"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.1.5"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.14", "versionEndExcluding": "7.2"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c"}, {"url": "https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7"}, {"url": "https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd"}, {"url": "https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e"}, {"url": "https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d"}, {"url": "https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21"}, {"url": "https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57"}, {"url": "https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543"}], "title": "ocfs2: reject FITRIM ranges shorter than a cluster", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:54:14.069402Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:55:34.720Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-74349", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T18:54:14.069402Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T18:54:15.271Z"}}], "cna": {"title": "ocfs2: reject FITRIM ranges shorter than a cluster", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - Exploitation requires a local FITRIM ioctl on an open OCFS2 mount (typically via fstrim or ioctl on the mountpoint); there is no network-facing OCFS2 handler or remote protocol path to this code.\nAC:L - An attacker with the required privileges can reliably trigger the bug by supplying a FITRIM range at least one block long but shorter than one cluster, which is common when OCFS2 cluster size exceeds the 4K block size.\nPR:L - The FITRIM handler explicitly requires capable(CAP_SYS_ADMIN) before calling ocfs2_trim_fs(); per kernel CNA guidance this maps to Low because CAP_SYS_ADMIN can be held by root inside a user namespace.\nUI:N - No victim interaction is required; the privileged attacker directly issues the FITRIM ioctl with crafted range parameters to trigger the faulty trim logic.\nS:U - Impact is confined to erroneous discard/trim operations within the same privileged filesystem context on the affected host and shared storage; it does not cross VM, container, or IOMMU security boundaries.\nC:N - The flaw causes incorrect discard of free clusters via sb_issue_discard and integer underflow in range arithmetic; it does not read kernel memory, leak pointers, or expose sensitive data to the attacker.\nI:H - Unsigned underflow can drive trimming far beyond the requested FITRIM range, issuing discard on extensive free-space regions on shared cluster storage and risking unintended loss or corruption of filesystem data integrity.\nA:H - Corrupted len/last_group values can cause prolonged iteration through cluster groups while holding the exclusive OCFS2 cluster-wide trim DLM lock, enabling severe denial of service or hang for the node and other cluster members."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "d903d59c0315f59bdf0214b4f13d71c9feb2c45c", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "441abb77222f155e8d931dbabb465466db01cfd7", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "e652d0f5108e447b22da4249bcd23dd1b63c73dd", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "346314bb0cc2fc52b50b73d6ecc62e0217455c2e", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "06c0a0431b9856506fcd9b2c1b0c6136567d756d", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "3fa7139b5f42731a61f78c42433adae13f9adc21", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "2c13e02592b918be7725ab5965e01ef4e46c4b57", "versionType": "git"}, {"status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "lessThan": "ca1afd88f5eaaff9168e1466e5401385edf59543", "versionType": "git"}], "programFiles": ["fs/ocfs2/alloc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"status": "unaffected", "version": "0", "lessThan": "3.14", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.261", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.212", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.178", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.145", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.97", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.40", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.5", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/ocfs2/alloc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c"}, {"url": "https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7"}, {"url": "https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd"}, {"url": "https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e"}, {"url": "https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d"}, {"url": "https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21"}, {"url": "https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57"}, {"url": "https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject FITRIM ranges shorter than a cluster\n\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb->s_blocksize.\n\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0. The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\n\nReject ranges shorter than s_clustersize instead. That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.261", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.212", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.178", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.145", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.97", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.40", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1.5", "versionStartIncluding": "3.14"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.2", "versionStartIncluding": "3.14"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-17T05:46:12.774Z"}}}, "cveMetadata": {"cveId": "CVE-2026-74349", "state": "PUBLISHED", "dateUpdated": "2026-10-16T18:55:34.720Z", "dateReserved": "2026-08-15T05:44:03.886Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-08-15T05:58:36.630Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/ocfs2/alloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d903d59c0315f59bdf0214b4f13d71c9feb2c45c", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "441abb77222f155e8d931dbabb465466db01cfd7", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "e652d0f5108e447b22da4249bcd23dd1b63c73dd", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "346314bb0cc2fc52b50b73d6ecc62e0217455c2e", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "06c0a0431b9856506fcd9b2c1b0c6136567d756d", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "3fa7139b5f42731a61f78c42433adae13f9adc21", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "2c13e02592b918be7725ab5965e01ef4e46c4b57", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}, {"lessThan": "ca1afd88f5eaaff9168e1466e5401385edf59543", "status": "affected", "version": "aa89762c54800208d5afdcd8e6bf124818f17fe0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/ocfs2/alloc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.14"}, {"lessThan": "3.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.261", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.212", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.178", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.145", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.97", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.40", "versionType": "semver"}, {"lessThanOrEqual": "7.1.*", "status": "unaffected", "version": "7.1.5", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: reject FITRIM ranges shorter than a cluster\n\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb->s_blocksize.\n\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0. The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\n\nReject ranges shorter than s_clustersize instead. That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk."}], "id": "CVE-2026-74349", "lastModified": "2026-10-16T19:17:40.977", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.1, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.2, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-74349", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T18:54:14.069402Z", "version": "2.0.3"}}]}, "published": "2026-08-15T06:22:36.130", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: ocfs2: reject FITRIM ranges shorter than a cluster", "id": "2516931", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516931"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nocfs2: reject FITRIM ranges shorter than a cluster\nocfs2_trim_mainbm() trims the global bitmap in cluster units, but its\ntoo-short range validation only checks sb->s_blocksize.\nOn filesystems with a cluster size larger than the block size, a FITRIM\nrange that is at least one block but shorter than one cluster is accepted\nand shifted down to len == 0. The later start + len - 1 and len -= ... \narithmetic then underflows and can drive trimming past the requested\nrange.\nReject ranges shorter than s_clustersize instead. That preserves the\nexisting -EINVAL behavior for requests that cannot discard even one\nallocation unit and keeps zero-cluster trims out of the group walk.", "A flaw was found in the Linux kernel's OCFS2 (Oracle Cluster File System version 2) component. A local attacker with appropriate permissions could trigger an issue during filesystem trimming operations. By providing a specific range for trimming that is smaller than expected, an internal calculation error (integer underflow) occurs. This error could cause the system to trim data outside the intended area, potentially leading to data corruption or making the system unavailable (Denial of Service)."], "name": "CVE-2026-74349", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-08-15T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-74349\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-74349\nhttps://lore.kernel.org/linux-cve-announce/2026081559-CVE-2026-74349-d8b3@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,d903d59c0315f59bdf0214b4f13d71c9feb2c45c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,441abb77222f155e8d931dbabb465466db01cfd7)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,e652d0f5108e447b22da4249bcd23dd1b63c73dd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,346314bb0cc2fc52b50b73d6ecc62e0217455c2e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,06c0a0431b9856506fcd9b2c1b0c6136567d756d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,3fa7139b5f42731a61f78c42433adae13f9adc21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,2c13e02592b918be7725ab5965e01ef4e46c4b57)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[aa89762c54800208d5afdcd8e6bf124818f17fe0,ca1afd88f5eaaff9168e1466e5401385edf59543)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "3.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,3.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.261,5.11.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.212,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.178,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.145,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.97,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.40,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.1.5,7.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-08-15T13:00:05.628320+00:00", "updated": "2026-08-22T03:00:12.237006+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}