CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster

CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: reject FITRIM ranges shorter than a cluster

ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its
too-short range validation only checks sb->s_blocksize.

On filesystems with a cluster size larger than the block size, a FITRIM
range that is at least one block but shorter than one cluster is accepted
and shifted down to len == 0.  The later start + len - 1 and len -= ... 
arithmetic then underflows and can drive trimming past the requested
range.

Reject ranges shorter than s_clustersize instead.  That preserves the
existing -EINVAL behavior for requests that cannot discard even one
allocation unit and keeps zero-cluster trims out of the group walk.

The Linux kernel CVE team has assigned CVE-2026-74349 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 5.10.261 with commit d903d59c0315f59bdf0214b4f13d71c9feb2c45c
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 5.15.212 with commit 441abb77222f155e8d931dbabb465466db01cfd7
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.1.178 with commit e652d0f5108e447b22da4249bcd23dd1b63c73dd
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.6.145 with commit 346314bb0cc2fc52b50b73d6ecc62e0217455c2e
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.12.97 with commit 06c0a0431b9856506fcd9b2c1b0c6136567d756d
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.18.40 with commit 3fa7139b5f42731a61f78c42433adae13f9adc21
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 7.1.5 with commit 2c13e02592b918be7725ab5965e01ef4e46c4b57
	Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 7.2-rc1 with commit ca1afd88f5eaaff9168e1466e5401385edf59543

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-74349
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	fs/ocfs2/alloc.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c
	https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7
	https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd
	https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e
	https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d
	https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21
	https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57
	https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543