CVE-2026-74348

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2/dlm: require a ref for locking_state debugfs open

debug_lockres_open() copies inode->i_private into struct debug_lockres and

debug_lockres_release() later drops that pointer with dlm_put(). That

only works if open successfully pins the struct dlm_ctxt.

Today open calls dlm_grab(dlm) but ignores its return value. Once the

last domain unregister has removed the context from dlm_domains,

dlm_grab() returns NULL, yet open still stores the raw pointer and returns

success. The later release path is outside the debugfs removal barrier,

so it can call dlm_put() after dlm_free_ctxt_mem() has freed the context.

KASAN reports this as a slab-use-after-free in dlm_put() called from

debug_lockres_release().

Fail the open when dlm_grab() cannot acquire the reference and unwind the

seq_file private state before returning. That keeps locking_state from

handing out a file descriptor whose release path does not own the

dlm

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References