ACK: [SRU][J][PATCH 0/1] CVE-2026-74350

[Magali Lemes]

Acked-by: Magali Lemes <magali.lemes at canonical.com>

On 10/6/26 06:36, Javier Carrasco via kernel-team wrote:
> https://ubuntu.com/security/CVE-2026-74350
> 
> [ Impact ]
> 
> In the Linux kernel, the following vulnerability has been resolved:
> 
> ocfs2: validate fast symlink target during inode read
> 
> ocfs2_validate_inode_block() rejects several inconsistent self-contained
> dinodes before they are exposed to the rest of the filesystem. Fast
> symlinks need the same treatment.
> 
> A zero-cluster symlink is treated as a fast symlink and later read through
> page_get_link() and ocfs2_fast_symlink_read_folio(). That path uses
> strnlen() on the inline payload and then copies len + 1 bytes into the
> folio.
> If a corrupt dinode stores an i_size that does not fit the inline area or
> omits the terminating NUL at i_size, that copy reads past the end of the
> inode block buffer.
> 
> This can result in an out-of-bounds read and a kernel denial of service
> when a malformed ocfs2 filesystem image is mounted and the affected symlink
> is read.
> 
> Ubuntu has assessed this issue as High severity, with a CVSS v4 score of
> 7.1.
> 
> [ Fix ]
> 
> Backported from upstream commit:
> 
> e234973f286ed2e8961a24561ec91594ec3e3ff8
> ("ocfs2: validate fast symlink target during inode read")
> 
> The fix validates zero-cluster symlink dinodes during inode-block
> validation. It rejects fast symlinks whose i_size exceeds the available
> inline capacity or whose inline payload is not NUL-terminated at i_size.
> This prevents malformed fast symlinks from reaching
> ocfs2_fast_symlink_read_folio(), where the out-of-bounds read could occur.
> 
> [ Test Plan ]
> 
> Build and boot tested.
> 
> [ Where Problems Could Occur ]
> 
> The patch is isolated to ocfs2 inode validation in fs/ocfs2/inode.c. The
> main risk is that unusual ocfs2 fast symlinks could be rejected if
> their inline payload or size does not meet the expected on-disk format. No
> changes are made to other filesystems or to the general symlink read path,
> so the risk of broader filesystem regressions is low.
> 
> Zhang Cen (1):
>    ocfs2: validate fast symlink target during inode read
> 
>   fs/ocfs2/inode.c | 23 +++++++++++++++++++++++
>   1 file changed, 23 insertions(+)
> 
> --
> 2.43.0
>