CVE-2026-74351

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: rebase copied fsdlm LVB pointers in locking_state

The lockingstate debugfs iterator snapshots struct ocfs2lockres by value under ocfs2dlmtrackinglock and later formats that copy in ocfs2dlmseqshow(). That is fine for the inline fields, but the userspace fsdlm stack stores the LVB through lksbfsdlm.sblvbptr. Once the iterator drops the tracking lock, a copied non-NULL sblvbptr still points into the original lockres owner, so teardown can free that container before the debugfs dump walks the raw LVB bytes.

Rebase the copied sblvbptr to the copied llksb before dumping the raw LVB. The seq snapshot already carries the inline LVB storage reserved in struct ocfs2dlmlksb, so the debugfs reader can dump the copied bytes without borrowing the original lockres lifetime.

The buggy scenario involves two paths, with each column showing the order within that path:

lockingstate reader: lockres teardown: 1. ocfs2dlmseqstart()/next() 1. file release or another owner copies struct ocfs2lockres teardown reaches 2. ocfs2dlmseqshow() formats ocfs2lockresfree() the copied row 2. the lockres is removed from the 3. ocfs2dlmlvb() follows the tracking list copied sb_lvbptr 3. the owner frees the original lockres container

Validation reproduced this kernel report: KASAN slab-use-after-free in ocfs2dlmseqshow+0x1bd/0x430 RIP: 0033:0x7f8ec4b1e29d The buggy address belongs to the object at ffff88810a1e0800 which belongs to the cache kmalloc-1k of size 1024 The buggy address is located 368 bytes inside of freed 1024-byte region [ffff88810a1e0800, ffff88810a1e0c00) Read of size 1 Call trace: dumpstacklvl+0x66/0xa0 printreport+0xce/0x630 ocfs2dlmseqshow+0x1bd/0x430 (fs/ocfs2/dlmglue.c:3137) srsoaliasreturnthunk+0x5/0xfbef5 __virtaddrvalid+0x19f/0x330 kasanreport+0xe0/0x110 seqreaditer+0x29d/0x790 seqread+0x20a/0x280 findheldlock+0x2b/0x80 rcureadunlock+0x18/0x70 fullproxyread+0x9e/0xd0 vfsread+0x12c/0x590 ksysread+0xd2/0x170 douseraddrfault+0x65a/0x890 dosyscall64+0x115/0x6a0 (arch/x86/entry/syscall64.c:87) entrySYSCALL64afterhwframe+0x77/0x7f Allocated by task stack: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 __kasankmalloc+0xaa/0xb0 ocfs2fileopen+0x13e/0x300 dodentryopen+0x233/0x7f0 vfsopen+0x5a/0x1b0 pathopenat+0x66d/0x1540 dofileopen+0x186/0x2b0 dosys_openat2+0xce/0x150 __x64sysopenat+0xd0/0x140 dosyscall64+0x115/0x6a0 (arch/x86/entry/syscall64.c:87) entrySYSCALL64afterhwframe+0x77/0x7f Freed by task stack: kasansavestack+0x33/0x60 kasansavetrack+0x14/0x30 kasansavefreeinfo+0x3b/0x60 __kasanslabfree+0x5f/0x80 kfree+0x313/0x590 ocfs2filerelease+0x138/0x260 __fput+0x1df/0x4b0 fputclosesync+0xd2/0x170 _x64sysclose+0x55/0x90 dosyscall64+0x115/0x6a0 (arch/x86/entry/syscall64.c:87) entrySYSCALL64afterhwframe+0x77/0x7f