{"cve":"CVE-2026-74351","nvd":{"published":"2026-08-15T06:22:36.383","modified":"2026-08-17T06:19:29.780","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: rebase copied fsdlm LVB pointers in locking_state\n\nThe locking_state debugfs iterator snapshots struct ocfs2_lock_res by\nvalue under ocfs2_dlm_tracking_lock and later formats that copy in\nocfs2_dlm_seq_show().  That is fine for the inline fields, but the\nuserspace fsdlm stack stores the LVB through lksb_fsdlm.sb_lvbptr.  Once\nthe iterator drops the tracking lock, a copied non-NULL sb_lvbptr still\npoints into the original lockres owner, so teardown can free that\ncontainer before the debugfs dump walks the raw LVB bytes.\n\nRebase the copied sb_lvbptr to the copied l_lksb before dumping the raw\nLVB.  The seq snapshot already carries the inline LVB storage reserved in\nstruct ocfs2_dlm_lksb, so the debugfs reader can dump the copied bytes\nwithout borrowing the original lockres lifetime.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nlocking_state reader:                  lockres teardown:\n1. ocfs2_dlm_seq_start()/next()        1. file release or another owner\n   copies struct ocfs2_lock_res           teardown reaches\n2. ocfs2_dlm_seq_show() formats           ocfs2_lock_res_free()\n   the copied row                      2. the lockres is removed from the\n3. ocfs2_dlm_lvb() follows the            tracking list\n   copied sb_lvbptr                   3. the owner frees the original\n                                          lockres container\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in ocfs2_dlm_seq_show+0x1bd/0x430\nRIP: 0033:0x7f8ec4b1e29d\nThe buggy address belongs to the object at ffff88810a1e0800 which belongs\nto the cache kmalloc-1k of size 1024\nThe buggy address is located 368 bytes inside of freed 1024-byte region\n[ffff88810a1e0800, ffff88810a1e0c00)\nRead of size 1\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  ocfs2_dlm_seq_show+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137)\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x19f/0x330\n  kasan_report+0xe0/0x110\n  seq_read_iter+0x29d/0x790\n  seq_read+0x20a/0x280\n  find_held_lock+0x2b/0x80\n  rcu_read_unlock+0x18/0x70\n  full_proxy_read+0x9e/0xd0\n  vfs_read+0x12c/0x590\n  ksys_read+0xd2/0x170\n  do_user_addr_fault+0x65a/0x890\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  ocfs2_file_open+0x13e/0x300\n  do_dentry_open+0x233/0x7f0\n  vfs_open+0x5a/0x1b0\n  path_openat+0x66d/0x1540\n  do_file_open+0x186/0x2b0\n  do_sys_openat2+0xce/0x150\n  __x64_sys_openat+0xd0/0x140\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\nFreed by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x5f/0x80\n  kfree+0x313/0x590\n  ocfs2_file_release+0x138/0x260\n  __fput+0x1df/0x4b0\n  fput_close_sync+0xd2/0x170\n  __x64_sys_close+0x55/0x90\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f","cvss_v4":null,"cvss_v3":null,"cwes":[],"references":["https://git.kernel.org/stable/c/07aa4a8ebacde3d0ba50f60d2964f274ee7629bc","https://git.kernel.org/stable/c/185427b5f7a209254c85c18aad5a4a8e009b2f30","https://git.kernel.org/stable/c/610a0d2a35496738e1472fb0f318d5008a1c634f","https://git.kernel.org/stable/c/6b38a5b8ee951e5b244e9a3c3d28d0f5e7c51411","https://git.kernel.org/stable/c/8614a8f7e81edd34c9f67e454e7024fd12a2a341"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:49:10.689564601+00:00"},"epss":{"cve":"CVE-2026-74351","score":0.0022,"percentile":0.12509,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}