From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B1E37384230 for ; Sat, 15 Aug 2026 06:36:10 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775771; cv=none; b=DZ93yNIitli8sHcEOlTXyvLB0mUIaZellqhTD18CQwq6Gpe2JALBqKSdugQ/3ww4KpnR8ItC6eLSXgSn34SW7UZ59BYHGf3ndoDClLiWviAcCbdTx1sswA/KqMVAoBt6TO9eHYC+Gr3+b52TQ9kyb8UjjfKQuO4SRAOY4aX0J4E= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786775771; c=relaxed/simple; bh=U7yVAWzOf9USMR3OkV4JWxnmzVld3hdzvJRmOBzBRTM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Lgxp+4m0UrOtKp1vTmo+Ca06txdHOGzVFeOneD4LdTM7KA6rsxWPnimj2ypC/BI4iQ+P5ewJ313vtmqkaaeZbZ8XHqyLpG/NaOHGirPnh+mkRp70kwtV+d96JGoZRtQqH1p4eHfx78D6cv0Vm+KRk0I6t1IV+ghipEppr2q/4Kg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PQriuYjK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PQriuYjK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1423D1F000E9; Sat, 15 Aug 2026 06:36:09 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786775770; bh=j+ILJTHhx+zu2xN1MTVijw1O7P1LG0pFVwGfkOpvcgo=; h=From:To:Cc:Subject:Date:Reply-To; b=PQriuYjKvY4wTVp4ur6YwACLbXi6w8Ic1ybBAjnnlSCdlQj801wsY+XIUP0y/AH87 OOLn5dNiCyBNqFd1nhqr3h3cEq49jZ/F3IJouCobh9ve9jTOrbCBFduWt0571HfXbK eGknsPyZy+Ao66LY9dOvcSL+tTHfjtX3vFzetkEI= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster Date: Sat, 15 Aug 2026 15:11:16 +0900 Message-ID: <2026081559-CVE-2026-74349-d8b3@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3767; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=JBHiO/1YJjGPChrkJGjQBy2JCdfE5loXX7UZRdmISAQ=; b=kA0DAAIRMUfUDdst+ykByyZiAGqAAROjpKBYcuvtEIiGlJe1DLU4MTRCHow2jKC8ZSnv1OzCo ohdBAARAgAdFiEE9LYMxb94wiFKMT3LMUfUDdst+ykFAmqAARMACgkQMUfUDdst+ym0MwCffdNH 0cdPpk2kI6pFjTedXiOyZ74AoIQKL+S/Llj9gmGbx7x2qkq5FF/P X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject FITRIM ranges shorter than a cluster ocfs2_trim_mainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->s_blocksize. On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range. Reject ranges shorter than s_clustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk. The Linux kernel CVE team has assigned CVE-2026-74349 to this issue. Affected and fixed versions =========================== Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 5.10.261 with commit d903d59c0315f59bdf0214b4f13d71c9feb2c45c Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 5.15.212 with commit 441abb77222f155e8d931dbabb465466db01cfd7 Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.1.178 with commit e652d0f5108e447b22da4249bcd23dd1b63c73dd Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.6.145 with commit 346314bb0cc2fc52b50b73d6ecc62e0217455c2e Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.12.97 with commit 06c0a0431b9856506fcd9b2c1b0c6136567d756d Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 6.18.40 with commit 3fa7139b5f42731a61f78c42433adae13f9adc21 Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 7.1.5 with commit 2c13e02592b918be7725ab5965e01ef4e46c4b57 Issue introduced in 3.14 with commit aa89762c54800208d5afdcd8e6bf124818f17fe0 and fixed in 7.2-rc1 with commit ca1afd88f5eaaff9168e1466e5401385edf59543 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-74349 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/alloc.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/d903d59c0315f59bdf0214b4f13d71c9feb2c45c https://git.kernel.org/stable/c/441abb77222f155e8d931dbabb465466db01cfd7 https://git.kernel.org/stable/c/e652d0f5108e447b22da4249bcd23dd1b63c73dd https://git.kernel.org/stable/c/346314bb0cc2fc52b50b73d6ecc62e0217455c2e https://git.kernel.org/stable/c/06c0a0431b9856506fcd9b2c1b0c6136567d756d https://git.kernel.org/stable/c/3fa7139b5f42731a61f78c42433adae13f9adc21 https://git.kernel.org/stable/c/2c13e02592b918be7725ab5965e01ef4e46c4b57 https://git.kernel.org/stable/c/ca1afd88f5eaaff9168e1466e5401385edf59543