Use-after-free in Linux kernel - CVE-2026-74351

Vulnerability identifier: #VU142839

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-74351

CWE-ID: CWE-416

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local user to disclose sensitive information.

The vulnerability exists due to a use-after-free in the ocfs2 locking_state debugfs iterator when dumping raw LVB bytes from a copied lock resource after lockres teardown. A local user can read the debugfs locking_state output during a concurrent teardown to disclose sensitive information.

The issue occurs because a copied non-NULL sb_lvbptr can continue to reference the original lock resource after the tracking lock is dropped.

Linux kernel
Ubuntu
linux-nvidia (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux (Ubuntu package)
linux-oem-7.0 (Ubuntu package)
linux-azure-7.0 (Ubuntu package)
linux-azure (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux-nvidia (Ubuntu package) - addressed in versions 5.15.0-1112.113, 5.15.0.1112.112
linux-gcp-7.0 (Ubuntu package) - addressed in versions 7.0.0-38.38~24.04.4, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14~24.04.1
linux (Ubuntu package) - addressed in versions 7.0.0-38.38, 7.0.0-38.38.1, 7.0.0-1008.9, 7.0.0-1013.13~24.04.1, 7.0.0-1014.14, 7.0.0-1015.15
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1015.15
linux-azure-7.0 (Ubuntu package) - addressed in versions 7.0.0-1016.16~24.04.1, 7.0.0-1017.17~24.04.1
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1017.17

• https://git.kernel.org/stable/c/07aa4a8ebacde3d0ba50f60d2964f274ee7629bc
• https://git.kernel.org/stable/c/185427b5f7a209254c85c18aad5a4a8e009b2f30
• https://git.kernel.org/stable/c/610a0d2a35496738e1472fb0f318d5008a1c634f
• https://git.kernel.org/stable/c/6b38a5b8ee951e5b244e9a3c3d28d0f5e7c51411
• https://git.kernel.org/stable/c/8614a8f7e81edd34c9f67e454e7024fd12a2a341
• https://git.kernel.org/stable/c/93612d48fa42b3d1a637eb9279e15281c611c000
• https://git.kernel.org/stable/c/bb44a7690a4d553da705919cf666a80f5ca9011c
• https://git.kernel.org/stable/c/e037c1250cc90e7aacb002357d1b0399fc65ecfc

• Use-after-free in Linux kernel ocfs2
• Ubuntu update for linux-gcp-7.0
• Ubuntu update for linux-nvidia
• Ubuntu update for linux-azure-7.0
• Ubuntu update for linux
• Ubuntu update for linux-azure
• Ubuntu update for linux-oem-7.0