UBUNTU-CVE-2026-74350: Use After Free

Q: Which systems are exposed to this issue?

Systems running the listed Ubuntu kernel packages are potentially affected if they use the OCFS2 filesystem and process a malformed zero-cluster (fast) symbolic link. The affected package list includes standard, AWS, Azure, GCP, FIPS, AWS FIPS, and Azure FIPS Ubuntu kernel variants.

Q: What does exploitation require?

An attacker needs to cause the system to read a malformed OCFS2 fast-symlink inode. The malformed inode must have an inline size beyond the fast-symlink capacity or lack a NUL terminator exactly at its declared size; user interaction is required according to the supplied vector.

Q: What is the impact of reading a malicious symlink?

The vulnerable read path can copy beyond the inode block buffer while resolving the symlink. The reported validation reproduced a KASAN-detected memory-safety failure in ocfs2_fast_symlink_read_folio(), and the availability impact is rated high.

Q: How can exposure be reduced before an update is available?

Avoid mounting or accessing untrusted OCFS2 filesystems, particularly filesystems that may contain attacker-controlled symlinks. The provided data does not identify a configuration-only mitigation for trusted OCFS2 deployments.

Published Aug 15, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate fast symlink target during inode read ocfs2validateinodeblock() already rejects several inconsistent self-contained dinodes before they are exposed to the rest of the filesystem. Fast symlinks need the same treatment. A zero-cluster symlink is treated as a fast symlink and later read through pagegetlink() and ocfs2fastsymlinkreadfolio(). That path uses strnlen() on the inline payload and then copies len + 1 bytes into the folio. If a corrupt dinode stores an isize that does not fit the inline area or omits the terminating NUL at isize, that copy reads past the end of the inode block buffer. Reject zero-cluster symlink dinodes whose isize exceeds the inline fast-symlink capacity or whose inline payload is not NUL-terminated exactly at isize when the inode block is validated. This keeps malformed fast symlinks from reaching the read path. Validation reproduced this kernel report: KASAN use-after-free in ocfs2fastsymlinkreadfolio+0x12c/0x1f0 RIP: 0033:0x7f5c6d859aa7 Read of size 3905 Call trace: dumpstacklvl+0x66/0xa0 (?:?) printreport+0xce/0x630 (?:?) ocfs2fastsymlinkreadfolio+0x12c/0x1f0 (fs/ocfs2/inode.c:?) srsoaliasreturnthunk+0x5/0xfbef5 (?:?) virtaddrvalid+0x19f/0x330 (?:?) kasanreport+0xe0/0x110 (?:?) kasancheckrange+0x105/0x1b0 (?:?) asanmemcpy+0x23/0x60 (?:?) filemapreadfolio+0x27/0xe0 (?:?) filemapreadfolio+0x35/0xe0 (?:?) doreadcachefolio+0x138/0x230 (?:?) pagegetlink+0x26/0x110 (?:?) pagegetlink+0x2e/0x70 (?:?) vfsreadlink+0x15e/0x250 (?:?) touchatime+0x4d/0x370 (?:?) doreadlinkat+0x186/0x200 (?:?) douseraddrfault+0x65a/0x890 (?:?) x64sysreadlink+0x46/0x60 (?:?) dosyscall64+0x115/0x6a0 (arch/x86/entry/syscall64.c:87) entrySYSCALL64afterhwframe+0x77/0x7f (?:?)

Affected Software

255 affected componentsFixes available

ubuntu/linux*

ubuntu/linux-aws<4.4.0-1162.168

4.4.0-1162.168

ubuntu/linux-azure*

ubuntu/linux-lts-xenial<4.4.0-291.325~14.04.1

4.4.0-291.325~14.04.1

ubuntu/linux<4.4.0-291.325

4.4.0-291.325

ubuntu/linux-aws<4.4.0-1200.215

4.4.0-1200.215

ubuntu/linux-aws-hwe*

ubuntu/linux-azure*

ubuntu/linux-gcp*

ubuntu/linux-hwe*

ubuntu/linux-hwe-edge*

ubuntu/linux-kvm<4.4.0-1163.174

4.4.0-1163.174

ubuntu/linux-oracle*

ubuntu/linux-fips*

ubuntu/linux*

ubuntu/linux-aws*

ubuntu/linux-aws-5.0*

ubuntu/linux-aws-5.3*

ubuntu/linux-aws-5.4<5.4.0-1167.178~18.04.1

5.4.0-1167.178~18.04.1

ubuntu/linux-azure*

ubuntu/linux-azure-4.15*

ubuntu/linux-azure-5.3*

ubuntu/linux-azure-5.4<5.4.0-1172.178~18.04.1

5.4.0-1172.178~18.04.1

ubuntu/linux-azure-edge*

ubuntu/linux-gcp*

ubuntu/linux-gcp-4.15*

ubuntu/linux-gcp-5.3*

ubuntu/linux-gcp-5.4<5.4.0-1170.180~18.04.1

5.4.0-1170.180~18.04.1

ubuntu/linux-gke-4.15*

ubuntu/linux-gke-5.4*

ubuntu/linux-gkeop-5.4*

ubuntu/linux-hwe*

ubuntu/linux-hwe-5.4<5.4.0-245.265~18.04.1

5.4.0-245.265~18.04.1

ubuntu/linux-hwe-edge*

ubuntu/linux-ibm-5.4<5.4.0-1113.118~18.04.1

5.4.0-1113.118~18.04.1

ubuntu/linux-kvm*

ubuntu/linux-oem*

ubuntu/linux-oracle*

ubuntu/linux-oracle-5.0*

ubuntu/linux-oracle-5.3*

ubuntu/linux-oracle-5.4<5.4.0-1165.175~18.04.1

5.4.0-1165.175~18.04.1

ubuntu/linux-raspi-5.4<5.4.0-1149.162~18.04.1

5.4.0-1149.162~18.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.4.0-245.265

5.4.0-245.265

ubuntu/linux-aws<5.4.0-1167.178

5.4.0-1167.178

ubuntu/linux-aws-5.11*

ubuntu/linux-aws-5.13*

ubuntu/linux-aws-5.15<5.15.0-1120.127~20.04.1

5.15.0-1120.127~20.04.1

ubuntu/linux-aws-5.8*

ubuntu/linux-azure<5.4.0-1172.178

5.4.0-1172.178

ubuntu/linux-azure-5.11*

ubuntu/linux-azure-5.13*

ubuntu/linux-azure-5.15<5.15.0-1126.135~20.04.1

5.15.0-1126.135~20.04.1

ubuntu/linux-azure-5.8*

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-5.15<5.15.0-1125.134~20.04.1

5.15.0-1125.134~20.04.1

ubuntu/linux-bluefield<5.4.0-1126.133

5.4.0-1126.133

ubuntu/linux-gcp<5.4.0-1170.180

5.4.0-1170.180

ubuntu/linux-gcp-5.11*

ubuntu/linux-gcp-5.13*

ubuntu/linux-gcp-5.15<5.15.0-1121.131~20.04.1

5.15.0-1121.131~20.04.1

ubuntu/linux-gcp-5.8*

ubuntu/linux-gke*

ubuntu/linux-gke-5.15*

ubuntu/linux-gkeop*

ubuntu/linux-gkeop-5.15*

ubuntu/linux-hwe-5.11*

ubuntu/linux-hwe-5.13*

ubuntu/linux-hwe-5.15<5.15.0-203.213~20.04.1

5.15.0-203.213~20.04.1

ubuntu/linux-hwe-5.8*

ubuntu/linux-ibm<5.4.0-1113.118

5.4.0-1113.118

ubuntu/linux-ibm-5.15<5.15.0-1114.118~20.04.1

5.15.0-1114.118~20.04.1

ubuntu/linux-intel-5.13*

ubuntu/linux-intel-iotg-5.15<5.15.0-1115.121~20.04.1

5.15.0-1115.121~20.04.1

ubuntu/linux-iot<5.4.0-1071.74

5.4.0-1071.74

ubuntu/linux-kvm<5.4.0-1154.163

5.4.0-1154.163

ubuntu/linux-lowlatency-hwe-5.15<5.15.0-198.208~20.04.1

5.15.0-198.208~20.04.1

ubuntu/linux-nvidia-tegra-5.15<5.15.0-1071.73~20.04.1

5.15.0-1071.73~20.04.1

ubuntu/linux-oem-5.10*

ubuntu/linux-oem-5.13*

ubuntu/linux-oem-5.6*

ubuntu/linux-oracle<5.4.0-1165.175

5.4.0-1165.175

ubuntu/linux-oracle-5.11*

ubuntu/linux-oracle-5.13*

ubuntu/linux-oracle-5.15<5.15.0-1117.123~20.04.1

5.15.0-1117.123~20.04.1

ubuntu/linux-oracle-5.8*

ubuntu/linux-raspi<5.4.0-1149.162

5.4.0-1149.162

ubuntu/linux-raspi2*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.11*

ubuntu/linux-riscv-5.15<5.15.0-1114.118~20.04.1

5.15.0-1114.118~20.04.1

ubuntu/linux-riscv-5.8*

ubuntu/linux-xilinx-zynqmp<5.4.0-1085.89

5.4.0-1085.89

ubuntu/linux-aws-fips<5.4.0-1167.178+fips1

5.4.0-1167.178+fips1

ubuntu/linux-azure-fips<5.4.0-1172.178+fips1

5.4.0-1172.178+fips1

ubuntu/linux-fips<5.4.0-1141.151

5.4.0-1141.151

ubuntu/linux-gcp-fips<5.4.0-1170.180+fips1

5.4.0-1170.180+fips1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux<5.15.0-203.213

5.15.0-203.213

ubuntu/linux-allwinner-5.19*

ubuntu/linux-aws<5.15.0-1120.127

5.15.0-1120.127

ubuntu/linux-aws-5.19*

ubuntu/linux-aws-6.2*

ubuntu/linux-aws-6.5*

ubuntu/linux-aws-6.8<6.8.0-1069.74~22.04.1

6.8.0-1069.74~22.04.1

ubuntu/linux-azure<5.15.0-1126.135

5.15.0-1126.135

ubuntu/linux-azure-5.19*

ubuntu/linux-azure-6.2*

ubuntu/linux-azure-6.5*

ubuntu/linux-azure-6.8<6.8.0-1073.82~22.04.1

6.8.0-1073.82~22.04.1

ubuntu/linux-azure-fde<5.15.0-1125.134

5.15.0-1125.134

ubuntu/linux-azure-fde-5.19*

ubuntu/linux-azure-fde-6.2*

ubuntu/linux-azure-fde-6.8<6.8.0-1071.78~22.04.1

6.8.0-1071.78~22.04.1

ubuntu/linux-gcp<5.15.0-1121.131

5.15.0-1121.131

ubuntu/linux-gcp-5.19*

ubuntu/linux-gcp-6.2*

ubuntu/linux-gcp-6.5*

ubuntu/linux-gcp-6.8<6.8.0-1073.81~22.04.1

6.8.0-1073.81~22.04.1

ubuntu/linux-gke<5.15.0-1116.122

5.15.0-1116.122

ubuntu/linux-gkeop<5.15.0-1103.111

5.15.0-1103.111

ubuntu/linux-hwe-5.19*

ubuntu/linux-hwe-6.2*

ubuntu/linux-hwe-6.5*

ubuntu/linux-ibm<5.15.0-1114.118

5.15.0-1114.118

ubuntu/linux-ibm-6.8<6.8.0-1069.70~22.04.1

6.8.0-1069.70~22.04.1

ubuntu/linux-intel-iot-realtime*

ubuntu/linux-intel-iotg<5.15.0-1115.121

5.15.0-1115.121

ubuntu/linux-kvm<5.15.0-1112.117

5.15.0-1112.117

ubuntu/linux-lowlatency<5.15.0-198.208

5.15.0-198.208

ubuntu/linux-lowlatency-hwe-5.19*

ubuntu/linux-lowlatency-hwe-6.2*

ubuntu/linux-lowlatency-hwe-6.5*

ubuntu/linux-lowlatency-hwe-6.8<6.8.0-149.149.1~22.04.1

6.8.0-149.149.1~22.04.1

ubuntu/linux-nvidia<5.15.0-1115.116

5.15.0-1115.116

ubuntu/linux-nvidia-6.2*

ubuntu/linux-nvidia-6.5*

ubuntu/linux-nvidia-6.8*

ubuntu/linux-nvidia-tegra<5.15.0-1071.73

5.15.0-1071.73

ubuntu/linux-nvidia-tegra-igx*

ubuntu/linux-oem-5.17*

ubuntu/linux-oem-6.0*

ubuntu/linux-oem-6.1*

ubuntu/linux-oem-6.5*

ubuntu/linux-oracle<5.15.0-1117.123

5.15.0-1117.123

ubuntu/linux-oracle-6.5*

ubuntu/linux-oracle-6.8<6.8.0-1067.71~22.04.1

6.8.0-1067.71~22.04.1

ubuntu/linux-raspi<5.15.0-1113.116

5.15.0-1113.116

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-5.19*

ubuntu/linux-riscv-6.5*

ubuntu/linux-starfive-5.19*

ubuntu/linux-starfive-6.2*

ubuntu/linux-starfive-6.5*

ubuntu/linux-xilinx-zynqmp*

ubuntu/linux-bluefield<5.15.0-1104.106

5.15.0-1104.106

ubuntu/linux-intel-iot-realtime<5.15.0-1112.116

5.15.0-1112.116

ubuntu/linux-realtime<5.15.0-1119.128

5.15.0-1119.128

ubuntu/linux-realtime-6.8<6.8.1-1064.65~22.04.1

6.8.1-1064.65~22.04.1

ubuntu/linux-aws-fips*

ubuntu/linux-azure-fips*

ubuntu/linux-fips*

ubuntu/linux-gcp-fips*

ubuntu/linux-aws-fips<5.15.0-1120.127+fips1

5.15.0-1120.127+fips1

ubuntu/linux-azure-fips<5.15.0-1126.135+fips1

5.15.0-1126.135+fips1

ubuntu/linux-fips*

ubuntu/linux-gcp-fips<5.15.0-1121.131+fips1

5.15.0-1121.131+fips1

ubuntu/linux<6.8.0-149.149

6.8.0-149.149

ubuntu/linux-aws<6.8.0-1069.74

6.8.0-1069.74

ubuntu/linux-aws-6.14*

ubuntu/linux-aws-6.17*

ubuntu/linux-aws-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-azure<6.8.0-1073.82

6.8.0-1073.82

ubuntu/linux-azure-6.11*

ubuntu/linux-azure-6.14*

ubuntu/linux-azure-6.17*

ubuntu/linux-azure-7.0<7.0.0-1017.17~24.04.1

7.0.0-1017.17~24.04.1

ubuntu/linux-azure-fde*

ubuntu/linux-azure-fde-6.14*

ubuntu/linux-azure-fde-6.17*

ubuntu/linux-azure-fde-7.0<7.0.0-1016.16~24.04.1

7.0.0-1016.16~24.04.1

ubuntu/linux-azure-nvidia*

ubuntu/linux-azure-nvidia-6.14*

ubuntu/linux-gcp<6.8.0-1073.81

6.8.0-1073.81

ubuntu/linux-gcp-6.11*

ubuntu/linux-gcp-6.14*

ubuntu/linux-gcp-7.0<7.0.0-1013.13~24.04.1

7.0.0-1013.13~24.04.1

ubuntu/linux-gke<6.8.0-1068.77

6.8.0-1068.77

ubuntu/linux-gkeop<6.8.0-1053.57

6.8.0-1053.57

ubuntu/linux-hwe-6.11*

ubuntu/linux-hwe-6.14*

ubuntu/linux-hwe-6.17*

ubuntu/linux-hwe-7.0<7.0.0-34.34~24.04.1

7.0.0-34.34~24.04.1

ubuntu/linux-ibm<6.8.0-1069.70

6.8.0-1069.70

ubuntu/linux-lowlatency<6.8.0-149.149.1

6.8.0-149.149.1

ubuntu/linux-lowlatency-hwe-6.11*

ubuntu/linux-nvidia<6.8.0-1067.70

6.8.0-1067.70

ubuntu/linux-nvidia-6.11*

ubuntu/linux-nvidia-6.17*

ubuntu/linux-nvidia-7.0<7.0.0-1024.25~24.04.1

7.0.0-1024.25~24.04.1

ubuntu/linux-nvidia-lowlatency*

ubuntu/linux-nvidia-tegra<6.8.0-1035.38

6.8.0-1035.38

ubuntu/linux-oem-6.11*

ubuntu/linux-oem-6.14*

ubuntu/linux-oem-6.17*

ubuntu/linux-oem-6.8*

ubuntu/linux-oracle<6.8.0-1067.71

6.8.0-1067.71

ubuntu/linux-oracle-6.14*

ubuntu/linux-oracle-6.17*

ubuntu/linux-oracle-7.0<7.0.0-1012.12~24.04.1

7.0.0-1012.12~24.04.1

ubuntu/linux-raspi<6.8.0-1068.72

6.8.0-1068.72

ubuntu/linux-raspi-realtime*

ubuntu/linux-realtime*

ubuntu/linux-riscv*

ubuntu/linux-riscv-6.14*

ubuntu/linux-riscv-6.17*

ubuntu/linux-riscv-7.0<7.0.0-34.34.1~24.04.1

7.0.0-34.34.1~24.04.1

ubuntu/linux-vmware<6.8.0-1010.10

6.8.0-1010.10

ubuntu/linux-xilinx*

ubuntu/linux-bluefield<6.8.0-1036.41

6.8.0-1036.41

ubuntu/linux-raspi-realtime<6.8.0-2056.58

6.8.0-2056.58

ubuntu/linux-realtime<6.8.1-1064.65

6.8.1-1064.65

ubuntu/linux-realtime-6.14*

ubuntu/linux-realtime-6.17*

ubuntu/linux-aws-fips<6.8.0-1069.74+fips1

6.8.0-1069.74+fips1

ubuntu/linux-azure-fips<6.8.0-1073.82+fips1

6.8.0-1073.82+fips1

ubuntu/linux-fips*

ubuntu/linux-gcp-fips<6.8.0-1073.81+fips1

6.8.0-1073.81+fips1

ubuntu/linux<7.0.0-34.34

7.0.0-34.34

ubuntu/linux-aws<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-azure<7.0.0-1017.17

7.0.0-1017.17

ubuntu/linux-azure-fde<7.0.0-1016.16

7.0.0-1016.16

ubuntu/linux-gcp<7.0.0-1013.13

7.0.0-1013.13

ubuntu/linux-gke<7.0.0-1007.8

7.0.0-1007.8

ubuntu/linux-ibm<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-nvidia*

ubuntu/linux-nvidia-bos<7.0.0-2022.23

7.0.0-2022.23

ubuntu/linux-oem-7.0<7.0.0-1014.14

7.0.0-1014.14

ubuntu/linux-oracle<7.0.0-1012.12

7.0.0-1012.12

ubuntu/linux-raspi<7.0.0-1020.20

7.0.0-1020.20

ubuntu/linux-realtime<7.0.0-34.34.1

7.0.0-34.34.1

ubuntu/linux-riscv<7.0.0-34.34.1

7.0.0-34.34.1

ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1162.168
Upgrade
Upgrade ubuntu/linux-lts-xenial to a version that resolves this vulnerability.
Fixed in 4.4.0-291.325~14.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 4.4.0-291.325
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 4.4.0-1200.215
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 4.4.0-1163.174
Upgrade
Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1167.178~18.04.1
Upgrade
Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1172.178~18.04.1
Upgrade
Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1170.180~18.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-245.265~18.04.1
Upgrade
Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.118~18.04.1
Upgrade
Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1165.175~18.04.1
Upgrade
Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.162~18.04.1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.4.0-245.265
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.4.0-1167.178
Upgrade
Upgrade ubuntu/linux-aws-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.127~20.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.4.0-1172.178
Upgrade
Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1126.135~20.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1125.134~20.04.1
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.4.0-1126.133
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.4.0-1170.180
Upgrade
Upgrade ubuntu/linux-gcp-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1121.131~20.04.1
Upgrade
Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-203.213~20.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.4.0-1113.118
Upgrade
Upgrade ubuntu/linux-ibm-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.118~20.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1115.121~20.04.1
Upgrade
Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.
Fixed in 5.4.0-1071.74
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.4.0-1154.163
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208~20.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1071.73~20.04.1
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.4.0-1165.175
Upgrade
Upgrade ubuntu/linux-oracle-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.123~20.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.4.0-1149.162
Upgrade
Upgrade ubuntu/linux-riscv-5.15 to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.118~20.04.1
Upgrade
Upgrade ubuntu/linux-xilinx-zynqmp to a version that resolves this vulnerability.
Fixed in 5.4.0-1085.89
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1167.178+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1172.178+fips1
Upgrade
Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1141.151
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.4.0-1170.180+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 5.15.0-203.213
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.127
Upgrade
Upgrade ubuntu/linux-aws-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74~22.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 5.15.0-1126.135
Upgrade
Upgrade ubuntu/linux-azure-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82~22.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 5.15.0-1125.134
Upgrade
Upgrade ubuntu/linux-azure-fde-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1071.78~22.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 5.15.0-1121.131
Upgrade
Upgrade ubuntu/linux-gcp-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81~22.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 5.15.0-1116.122
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 5.15.0-1103.111
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 5.15.0-1114.118
Upgrade
Upgrade ubuntu/linux-ibm-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.70~22.04.1
Upgrade
Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.
Fixed in 5.15.0-1115.121
Upgrade
Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.117
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 5.15.0-198.208
Upgrade
Upgrade ubuntu/linux-lowlatency-hwe-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149.1~22.04.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 5.15.0-1115.116
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 5.15.0-1071.73
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 5.15.0-1117.123
Upgrade
Upgrade ubuntu/linux-oracle-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.71~22.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 5.15.0-1113.116
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 5.15.0-1104.106
Upgrade
Upgrade ubuntu/linux-intel-iot-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1112.116
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 5.15.0-1119.128
Upgrade
Upgrade ubuntu/linux-realtime-6.8 to a version that resolves this vulnerability.
Fixed in 6.8.1-1064.65~22.04.1
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1120.127+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1126.135+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 5.15.0-1121.131+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74
Upgrade
Upgrade ubuntu/linux-aws-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82
Upgrade
Upgrade ubuntu/linux-azure-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17~24.04.1
Upgrade
Upgrade ubuntu/linux-azure-fde-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16~24.04.1
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81
Upgrade
Upgrade ubuntu/linux-gcp-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13~24.04.1
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 6.8.0-1068.77
Upgrade
Upgrade ubuntu/linux-gkeop to a version that resolves this vulnerability.
Fixed in 6.8.0-1053.57
Upgrade
Upgrade ubuntu/linux-hwe-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-34.34~24.04.1
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.70
Upgrade
Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.
Fixed in 6.8.0-149.149.1
Upgrade
Upgrade ubuntu/linux-nvidia to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.70
Upgrade
Upgrade ubuntu/linux-nvidia-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1024.25~24.04.1
Upgrade
Upgrade ubuntu/linux-nvidia-tegra to a version that resolves this vulnerability.
Fixed in 6.8.0-1035.38
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 6.8.0-1067.71
Upgrade
Upgrade ubuntu/linux-oracle-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12~24.04.1
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 6.8.0-1068.72
Upgrade
Upgrade ubuntu/linux-riscv-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-34.34.1~24.04.1
Upgrade
Upgrade ubuntu/linux-vmware to a version that resolves this vulnerability.
Fixed in 6.8.0-1010.10
Upgrade
Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.
Fixed in 6.8.0-1036.41
Upgrade
Upgrade ubuntu/linux-raspi-realtime to a version that resolves this vulnerability.
Fixed in 6.8.0-2056.58
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 6.8.1-1064.65
Upgrade
Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1069.74+fips1
Upgrade
Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.82+fips1
Upgrade
Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.
Fixed in 6.8.0-1073.81+fips1
Upgrade
Upgrade ubuntu/linux to a version that resolves this vulnerability.
Fixed in 7.0.0-34.34
Upgrade
Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.
Fixed in 7.0.0-1017.17
Upgrade
Upgrade ubuntu/linux-azure-fde to a version that resolves this vulnerability.
Fixed in 7.0.0-1016.16
Upgrade
Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.
Fixed in 7.0.0-1013.13
Upgrade
Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.
Fixed in 7.0.0-1007.8
Upgrade
Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-nvidia-bos to a version that resolves this vulnerability.
Fixed in 7.0.0-2022.23
Upgrade
Upgrade ubuntu/linux-oem-7.0 to a version that resolves this vulnerability.
Fixed in 7.0.0-1014.14
Upgrade
Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.
Fixed in 7.0.0-1012.12
Upgrade
Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.
Fixed in 7.0.0-1020.20
Upgrade
Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.
Fixed in 7.0.0-34.34.1
Upgrade
Upgrade ubuntu/linux-riscv to a version that resolves this vulnerability.
Fixed in 7.0.0-34.34.1
Compensating control
During inode-block validation, reject zero-cluster fast-symlink dinodes when i_size exceeds the inline fast-symlink capacity or when the inline payload is not NUL-terminated exactly at i_size.

Event History

Aug 15, 2026

CVE Published

via OSV·06:22 AM

Data Sourced

via OSV·06:22 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

Systems running the listed Ubuntu kernel packages are potentially affected if they use the OCFS2 filesystem and process a malformed zero-cluster (fast) symbolic link. The affected package list includes standard, AWS, Azure, GCP, FIPS, AWS FIPS, and Azure FIPS Ubuntu kernel variants.

What does exploitation require?

An attacker needs to cause the system to read a malformed OCFS2 fast-symlink inode. The malformed inode must have an inline size beyond the fast-symlink capacity or lack a NUL terminator exactly at its declared size; user interaction is required according to the supplied vector.

What is the impact of reading a malicious symlink?

The vulnerable read path can copy beyond the inode block buffer while resolving the symlink. The reported validation reproduced a KASAN-detected memory-safety failure in ocfs2_fast_symlink_read_folio(), and the availability impact is rated high.

How can exposure be reduced before an update is available?

Avoid mounting or accessing untrusted OCFS2 filesystems, particularly filesystems that may contain attacker-controlled symlinks. The provided data does not identify a configuration-only mitigation for trusted OCFS2 deployments.

UBUNTU-CVE-2026-74350: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What does exploitation require?

What is the impact of reading a malicious symlink?

How can exposure be reduced before an update is available?

Company

Resources

Contact