ACK: [SRU][N][PATCH 0/1] CVE-2026-74350

[Ivan Hu]

Acked-by: Ivan Hu <ivan.hu at canonical.com>

On Mon, Oct 5, 2026 at 7:30 PM Javier Carrasco via kernel-team <
kernel-team at lists.ubuntu.com> wrote:

> https://ubuntu.com/security/CVE-2026-74350
>
> [ Impact ]
>
> In the Linux kernel, the following vulnerability has been resolved:
>
> ocfs2: validate fast symlink target during inode read
>
> ocfs2_validate_inode_block() rejects several inconsistent self-contained
> dinodes before they are exposed to the rest of the filesystem. Fast
> symlinks need the same treatment.
>
> A zero-cluster symlink is treated as a fast symlink and later read through
> page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses
> strnlen() on the inline payload and then copies len + 1 bytes into the
> folio.
> If a corrupt dinode stores an i_size that does not fit the inline area or
> omits the terminating NUL at i_size, that copy reads past the end of the
> inode block buffer.
>
> This can result in an out-of-bounds read and a kernel denial of service
> when a malformed ocfs2 filesystem image is mounted and the affected symlink
> is read.
>
> Ubuntu has assessed this issue as High severity, with a CVSS v4 score of
> 7.1.
>
> [ Fix ]
>
> Backported from upstream commit:
>
> e234973f286ed2e8961a24561ec91594ec3e3ff8
> ("ocfs2: validate fast symlink target during inode read")
>
> The fix validates zero-cluster symlink dinodes during inode-block
> validation. It rejects fast symlinks whose i_size exceeds the available
> inline capacity or whose inline payload is not NUL-terminated at i_size.
> This prevents malformed fast symlinks from reaching
> ocfs2_fast_symlink_read_folio(), where the out-of-bounds read could occur.
>
> [ Test Plan ]
>
> Build and boot tested.
>
> [ Where Problems Could Occur ]
>
> The patch is isolated to ocfs2 inode validation in fs/ocfs2/inode.c. The
> main risk is that unusual ocfs2 fast symlinks could be rejected if
> their inline payload or size does not meet the expected on-disk format. No
> changes are made to other filesystems or to the general symlink read path,
> so the risk of broader filesystem regressions is low.
>
> Zhang Cen (1):
>   ocfs2: validate fast symlink target during inode read
>
>  fs/ocfs2/inode.c | 23 +++++++++++++++++++++++
>  1 file changed, 23 insertions(+)
>
> --
> 2.43.0
>
> --
> kernel-team mailing list
> kernel-team at lists.ubuntu.com
> https://lists.ubuntu.com/mailman/listinfo/kernel-team
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ubuntu.com/archives/kernel-team/attachments/20261006/f8c60ca1/attachment.html>