[SRU][X][PATCH 0/1] CVE-2026-74350

[Javier Carrasco]

https://ubuntu.com/security/CVE-2026-74350

[ Impact ]

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate fast symlink target during inode read

ocfs2_validate_inode_block() rejects several inconsistent self-contained
dinodes before they are exposed to the rest of the filesystem. Fast
symlinks need the same treatment.

A zero-cluster symlink is treated as a fast symlink and later read through
page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses
strnlen() on the inline payload and then copies len + 1 bytes into the
folio.
If a corrupt dinode stores an i_size that does not fit the inline area or
omits the terminating NUL at i_size, that copy reads past the end of the
inode block buffer.

This can result in an out-of-bounds read and a kernel denial of service
when a malformed ocfs2 filesystem image is mounted and the affected symlink
is read.

Ubuntu has assessed this issue as High severity, with a CVSS v4 score of
7.1.

[ Fix ]

Backported from upstream commit:

e234973f286ed2e8961a24561ec91594ec3e3ff8
("ocfs2: validate fast symlink target during inode read")

The fix validates zero-cluster symlink dinodes during inode-block
validation. It rejects fast symlinks whose i_size exceeds the available
inline capacity or whose inline payload is not NUL-terminated at i_size.
This prevents malformed fast symlinks from reaching
ocfs2_fast_symlink_read_folio(), where the out-of-bounds read could occur.

[ Test Plan ]

Build and boot tested.

[ Where Problems Could Occur ]

The patch is isolated to ocfs2 inode validation in fs/ocfs2/inode.c. The
main risk is that unusual ocfs2 fast symlinks could be rejected if
their inline payload or size does not meet the expected on-disk format. No
changes are made to other filesystems or to the general symlink read path,
so the risk of broader filesystem regressions is low.

Zhang Cen (1):
  ocfs2: validate fast symlink target during inode read

 fs/ocfs2/inode.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

--
2.43.0