< Back

CVE-2026-74351

Updated on 15 Aug 2026

Severity

6.3 Medium severity

Details

CVSS score: 6.3
Affected product
Affected component
Links: NIST CIRCL RHEL Ubuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: rebase copied fsdlm LVB pointers in locking_state

The locking_state debugfs iterator snapshots struct ocfs2_lock_res by value under ocfs2_dlm_tracking_lock and later formats that copy in ocfs2_dlm_seq_show(). That is fine for the inline fields, but the userspace fsdlm stack stores the LVB through lksb_fsdlm.sb_lvbptr. Once the iterator drops the tracking lock, a copied non-NULL sb_lvbptr still points into the original lockres owner, so teardown can free that container before the debugfs dump walks the raw LVB bytes.

Rebase the copied sb_lvbptr to the copied l_lksb before dumping the raw LVB. The seq snapshot already carries the inline LVB storage reserved in struct ocfs2_dlm_lksb, so the debugfs reader can dump the copied bytes without borrowing the original lockres lifetime.

The buggy scenario involves two paths, with each column showing the order within that path:

locking_state reader: lockres teardown:

ocfs2_dlm_seq_start()/next() 1. file release or another owner copies struct ocfs2_lock_res teardown reaches
ocfs2_dlm_seq_show() formats ocfs2_lock_res_free() the copied row 2. the lockres is removed from the
ocfs2_dlm_lvb() follows the tracking list copied sb_lvbptr 3. the owner frees the original lockres container

Validation reproduced this kernel report: KASAN slab-use-after-free in ocfs2_dlm_seq_show+0x1bd/0x430 RIP: 0033:0x7f8ec4b1e29d The buggy address belongs to the object at ffff88810a1e0800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 368 bytes inside of freed 1024-byte region [ffff88810a1e0800, ffff88810a1e0c00) Read of size 1 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 ocfs2_dlm_seq_show+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137) srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x19f/0x330 kasan_report+0xe0/0x110 seq_read_iter+0x29d/0x790 seq_read+0x20a/0x280 find_held_lock+0x2b/0x80 rcu_read_unlock+0x18/0x70 full_proxy_read+0x9e/0xd0 vfs_read+0x12c/0x590 ksys_read+0xd2/0x170 do_user_addr_fault+0x65a/0x890 do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f Allocated by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 ocfs2_file_open+0x13e/0x300 do_dentry_open+0x233/0x7f0 vfs_open+0x5a/0x1b0 path_openat+0x66d/0x1540 do_file_open+0x186/0x2b0 do_sys_openat2+0xce/0x150 __x64_sys_openat+0xd0/0x140 do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f Freed by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x5f/0x80 kfree+0x313/0x590 ocfs2_file_release+0x138/0x260 __fput+0x1df/0x4b0 fput_close_sync+0xd2/0x170 __x64_sys_close+0x55/0x90 do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87) entry_SYSCALL_64_after_hwframe+0x77/0x7f

Details

Affected product:: AlmaLinux 9.2 ESU , Amazon Linux 2 ELS , CentOS 6 ELS , CentOS 7 ELS , CentOS 8.4 ELS , CentOS 8.5 ELS , CentOS Stream 8 ELS , CloudLinux 7 ELS , Debian 10 ELS , Debian 11 ELS , Oracle Linux 6 ELS , Oracle Linux 7 ELS , RHEL 7 ELS , TuxCare 9.6 ESU , TuxCare 9.8 ESU , Ubuntu 16.04 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:: linux @ 4.19.0 (+19 more)

Fixes

Operating system / Project

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system	Status	Covered kernels
Debian 12	Released	42 kernels 6.1.177-1 6.1.38-1 6.1.38-2 6.1.38-4 6.1.52-1 6.1.55-1 6.1.64-1 6.1.66-1 6.1.69-1 6.1.76-1 6.1.27-1 6.1.67-1 6.1.85-1 6.1.90-1 6.1.94-1 6.1.99-1 6.1.106-3 6.1.112-1 6.1.115-1 6.1.119-1 6.1.123-1 6.1.128-1 6.1.124-1 6.1.129-1 6.1.133-1 6.1.135-1 6.1.137-1 6.1.140-1 6.1.139-1 6.1.147-1 6.1.148-1 6.1.153-1 6.1.158-1 6.1.159-1 6.1.162-1 6.1.164-1 6.1.170-1 6.1.170-3 6.1.172-1 6.1.174-1 6.1.170-2 6.1.176-1
Debian 13	Released	13 kernels 6.12.85-1 6.12.86-1 6.12.88-1 6.12.74-2 6.12.73-1 6.12.63-1 6.12.69-1 6.12.74-1 6.12.90-1 6.12.90-2 6.12.94-1 6.12.95-1 6.12.96-1
Oracle Linux 8 UEK 7	Released	112 kernels 5.15.0-102.110.5.el8uek 5.15.0-101.103.2.1.el8uek 5.15.0-8.91.4.1.el8uek 5.15.0-7.86.6.1.el8uek 5.15.0-2.52.3.el8uek 5.15.0-100.96.32.el8uek 5.15.0-5.76.5.1.el8uek 5.15.0-6.80.3.1.el8uek 5.15.0-3.60.5.1.el8uek 5.15.0-0.30.20.el8uek 5.15.0-1.43.4.1.el8uek 5.15.0-0.30.20.1.el8uek 5.15.0-1.43.4.2.el8uek 5.15.0-4.70.5.2.el8uek 5.15.0-104.119.4.2.el8uek 5.15.0-0.30.19.el8uek 5.15.0-105.125.6.2.el8uek 5.15.0-105.125.6.2.1.el8uek 5.15.0-105.125.6.2.2.el8uek 5.15.0-106.131.4.el8uek 5.15.0-200.131.27.el8uek 5.15.0-200.131.27.1.el8uek 5.15.0-201.135.6.el8uek 5.15.0-202.135.2.el8uek 5.15.0-102.110.5.1.el8uek 5.15.0-103.114.4.el8uek 5.15.0-203.146.5.1.el8uek 5.15.0-204.147.6.2.el8uek 5.15.0-204.147.6.3.el8uek 5.15.0-205.149.5.1.el8uek 5.15.0-205.149.5.4.el8uek 5.15.0-206.153.7.el8uek 5.15.0-206.153.7.1.el8uek 5.15.0-207.156.6.el8uek 5.15.0-208.159.3.el8uek 5.15.0-208.159.3.2.el8uek 5.15.0-209.161.7.el8uek 5.15.0-209.161.7.1.el8uek 5.15.0-209.161.7.2.el8uek 5.15.0-210.163.7.el8uek 5.15.0-300.163.18.el8uek 5.15.0-300.163.18.1.el8uek 5.15.0-300.163.18.1.1.el8uek 5.15.0-301.163.5.2.el8uek 5.15.0-302.167.6.el8uek 5.15.0-300.163.18.7.el8uek 5.15.0-302.167.6.1.el8uek 5.15.0-303.171.5.2.el8uek 5.15.0-303.171.5.2.1.el8uek 5.15.0-304.171.4.el8uek 5.15.0-304.171.4.1.el8uek 5.15.0-304.171.4.3.el8uek 5.15.0-303.171.5.2.2.el8uek 5.15.0-305.176.4.el8uek 5.15.0-306.177.4.el8uek 5.15.0-306.177.4.1.el8uek 5.15.0-307.178.5.el8uek 5.15.0-308.179.6.el8uek 5.15.0-308.179.6.2.el8uek 5.15.0-308.179.6.3.el8uek 5.15.0-309.180.4.el8uek 5.15.0-308.179.6.7.el8uek 5.15.0-309.180.4.2.el8uek 5.15.0-308.179.6.11.el8uek 5.15.0-310.184.5.2.el8uek 5.15.0-310.184.5.3.el8uek 5.15.0-311.185.9.el8uek 5.15.0-308.179.6.14.el8uek 5.15.0-312.187.5.el8uek 5.15.0-312.187.5.1.el8uek 5.15.0-312.187.5.2.el8uek 5.15.0-312.187.5.3.el8uek 5.15.0-308.179.6.16.el8uek 5.15.0-313.189.5.1.el8uek 5.15.0-313.189.5.2.el8uek 5.15.0-313.189.5.3.el8uek 5.15.0-314.193.5.3.el8uek 5.15.0-314.193.5.4.el8uek 5.15.0-314.193.5.5.el8uek 5.15.0-315.196.5.1.el8uek 5.15.0-315.196.5.2.el8uek 5.15.0-316.196.4.1.el8uek 5.15.0-316.196.4.2.el8uek 5.15.0-317.197.5.1.el8uek 5.15.0-317.197.5.2.el8uek 5.15.0-318.199.3.2.el8uek 5.15.0-318.199.3.2.1.el8uek 5.15.0-319.201.4.2.el8uek 5.15.0-319.201.4.3.el8uek 5.15.0-319.201.4.4.el8uek 5.15.0-319.201.4.6.el8uek 5.15.0-320.202.8.2.el8uek 5.15.0-320.202.8.3.el8uek 5.15.0-320.202.8.4.el8uek 5.15.0-320.202.8.5.el8uek 5.15.0-318.199.3.6.el8uek 5.15.0-321.202.5.el8uek 5.15.0-321.202.5.1.el8uek 5.15.0-321.202.5.2.el8uek 5.15.0-321.202.5.3.el8uek 5.15.0-322.203.3.2.el8uek 5.15.0-322.203.3.3.el8uek 5.15.0-322.203.3.4.el8uek 5.15.0-322.203.3.4.5.el8uek 5.15.0-308.179.6.18.el8uek 5.15.0-318.199.3.7.el8uek 5.15.0-322.203.3.5.el8uek 5.15.0-322.203.3.4.1.el8uek 5.15.0-323.211.3.3.el8uek 5.15.0-323.211.3.4.el8uek 5.15.0-323.211.3.5.el8uek 5.15.0-308.179.6.19.el8uek
Oracle Linux 9 UEK 7	Released	112 kernels 5.15.0-101.103.2.1.el9uek 5.15.0-8.91.4.1.el9uek 5.15.0-7.86.6.1.el9uek 5.15.0-5.76.5.1.el9uek 5.15.0-6.80.3.1.el9uek 5.15.0-3.60.5.1.el9uek 5.15.0-0.30.20.el9uek 5.15.0-100.96.32.el9uek 5.15.0-1.43.4.2.el9uek 5.15.0-2.52.3.el9uek 5.15.0-4.70.5.2.el9uek 5.15.0-1.43.4.1.el9uek 5.15.0-0.30.20.1.el9uek 5.15.0-102.110.5.el9uek 5.15.0-102.110.5.1.el9uek 5.15.0-103.114.4.el9uek 5.15.0-104.119.4.2.el9uek 5.15.0-0.30.19.el9uek 5.15.0-105.125.6.2.el9uek 5.15.0-105.125.6.2.1.el9uek 5.15.0-105.125.6.2.2.el9uek 5.15.0-106.131.4.el9uek 5.15.0-200.131.27.el9uek 5.15.0-200.131.27.1.el9uek 5.15.0-201.135.6.el9uek 5.15.0-202.135.2.el9uek 5.15.0-203.146.5.1.el9uek 5.15.0-204.147.6.2.el9uek 5.15.0-204.147.6.3.el9uek 5.15.0-205.149.5.1.el9uek 5.15.0-205.149.5.4.el9uek 5.15.0-206.153.7.el9uek 5.15.0-206.153.7.1.el9uek 5.15.0-207.156.6.el9uek 5.15.0-208.159.3.el9uek 5.15.0-208.159.3.2.el9uek 5.15.0-209.161.7.el9uek 5.15.0-209.161.7.1.el9uek 5.15.0-209.161.7.2.el9uek 5.15.0-210.163.7.el9uek 5.15.0-300.163.18.el9uek 5.15.0-300.163.18.1.el9uek 5.15.0-300.163.18.1.1.el9uek 5.15.0-301.163.5.2.el9uek 5.15.0-302.167.6.el9uek 5.15.0-300.163.18.7.el9uek 5.15.0-302.167.6.1.el9uek 5.15.0-303.171.5.2.el9uek 5.15.0-303.171.5.2.1.el9uek 5.15.0-304.171.4.el9uek 5.15.0-304.171.4.1.el9uek 5.15.0-304.171.4.3.el9uek 5.15.0-303.171.5.2.2.el9uek 5.15.0-305.176.4.el9uek 5.15.0-306.177.4.el9uek 5.15.0-306.177.4.1.el9uek 5.15.0-307.178.5.el9uek 5.15.0-308.179.6.el9uek 5.15.0-308.179.6.2.el9uek 5.15.0-308.179.6.3.el9uek 5.15.0-309.180.4.el9uek 5.15.0-308.179.6.7.el9uek 5.15.0-309.180.4.2.el9uek 5.15.0-308.179.6.11.el9uek 5.15.0-310.184.5.2.el9uek 5.15.0-310.184.5.3.el9uek 5.15.0-311.185.9.el9uek 5.15.0-308.179.6.14.el9uek 5.15.0-312.187.5.el9uek 5.15.0-312.187.5.1.el9uek 5.15.0-312.187.5.2.el9uek 5.15.0-312.187.5.3.el9uek 5.15.0-308.179.6.16.el9uek 5.15.0-313.189.5.1.el9uek 5.15.0-313.189.5.2.el9uek 5.15.0-313.189.5.3.el9uek 5.15.0-314.193.5.3.el9uek 5.15.0-314.193.5.4.el9uek 5.15.0-314.193.5.5.el9uek 5.15.0-315.196.5.1.el9uek 5.15.0-315.196.5.2.el9uek 5.15.0-316.196.4.1.el9uek 5.15.0-316.196.4.2.el9uek 5.15.0-317.197.5.1.el9uek 5.15.0-317.197.5.2.el9uek 5.15.0-318.199.3.2.el9uek 5.15.0-318.199.3.2.1.el9uek 5.15.0-319.201.4.2.el9uek 5.15.0-319.201.4.3.el9uek 5.15.0-319.201.4.4.el9uek 5.15.0-319.201.4.6.el9uek 5.15.0-320.202.8.2.el9uek 5.15.0-320.202.8.3.el9uek 5.15.0-320.202.8.4.el9uek 5.15.0-320.202.8.5.el9uek 5.15.0-318.199.3.6.el9uek 5.15.0-321.202.5.el9uek 5.15.0-321.202.5.1.el9uek 5.15.0-321.202.5.2.el9uek 5.15.0-321.202.5.3.el9uek 5.15.0-322.203.3.2.el9uek 5.15.0-322.203.3.3.el9uek 5.15.0-322.203.3.4.el9uek 5.15.0-322.203.3.4.5.el9uek 5.15.0-308.179.6.18.el9uek 5.15.0-318.199.3.7.el9uek 5.15.0-322.203.3.5.el9uek 5.15.0-322.203.3.4.1.el9uek 5.15.0-323.211.3.3.el9uek 5.15.0-323.211.3.4.el9uek 5.15.0-323.211.3.5.el9uek 5.15.0-308.179.6.19.el9uek
Ubuntu 22.04	Planned	—
Ubuntu 22.04 AWS	Planned	—
Ubuntu 22.04 Azure	Planned	—
Ubuntu 24.04	Planned	—
Ubuntu 24.04 AWS	Planned	—
Ubuntu 26.04	Will Not Fix	—

Release info

Copy page link

Open as a page

Advisory

CLSA-2025:1748945064

Operating system

CentOS 8.4 ELS

Published date

Nov 16, 2014

Project

Linux

Version

2.11.0-1~ubuntu16.04.1+tuxcare.els12

How to fix

Update command:

apt-get update
apt-get --only-upgrade install ansible*

Changelog

Insufficiently Random Passwords Leakage
Debian/patches/CVE-2020-10729.patch: Fix caching of Jinja2 expressions to prevent caching dynamic results
CVE-2020-10729

Updated packages

ansible_2.5.1+dfsg-1ubuntu0.1+tuxcare.els6_all.deb

CVE-2026-74351

Severity

Details

Overview

About vulnerability

Details

Statement

Fixes

Statement

KernelCare state

Unsubscribe