CVE-2026-74348

A flaw was found in the Linux kernel's OCFS2 Distributed Lock Manager (DLM). A local user could exploit a use-after-free vulnerability in the locking_state debugfs interface. This occurs because the debug_lockres_open() function does not correctly handle cases where a reference to a DLM context cannot be acquired, allowing a freed memory region to be accessed later. This flaw can lead to a system crash (Denial of Service) or potentially enable a local attacker to achieve arbitrary code execution.

This vulnerability is rated as Moderate impact because exploitation requires local access and depends on triggering a race condition during domain shutdown, which restricts the blast radius. Furthermore, supported Red Hat Enterprise Linux kernels are not affected by this flaw as the OCFS2 filesystem and its distributed lock manager are not enabled or built.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.