CVE-2026-74349: ocfs2: reject FITRIM ranges shorter than a cluster
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: reject FITRIM ranges shorter than a cluster
ocfs2trimmainbm() trims the global bitmap in cluster units, but its too-short range validation only checks sb->sblocksize.
On filesystems with a cluster size larger than the block size, a FITRIM range that is at least one block but shorter than one cluster is accepted and shifted down to len == 0. The later start + len - 1 and len -= ... arithmetic then underflows and can drive trimming past the requested range.
Reject ranges shorter than sclustersize instead. That preserves the existing -EINVAL behavior for requests that cannot discard even one allocation unit and keeps zero-cluster trims out of the group walk.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-74349?
CVE-2026-74349 has a risk rating of 15, indicating a significant level of severity.
How do I fix CVE-2026-74349?
To resolve CVE-2026-74349, ensure that the Linux kernel is updated to the latest version where this vulnerability has been patched.
What does CVE-2026-74349 affect?
CVE-2026-74349 affects the Linux kernel specifically in the ocfs2 filesystem handling of FITRIM operations.
What type of vulnerability is CVE-2026-74349?
CVE-2026-74349 is a validation vulnerability related to the processing of FITRIM ranges in the ocfs2 filesystem.
When was CVE-2026-74349 published?
CVE-2026-74349 was published on August 15, 2026.