CVE-2026-89494 (GCVE-0-2026-89494)
Vulnerability from cvelistv5
Published
2026-09-11 19:43
Modified
2026-10-19 08:47
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation. num_locks and lockname_len are bounded only on the sending side, and the message is never checked to actually carry num_locks migratable_lock entries. As a result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the kmalloc(data_len) copy of the message (an out-of-bounds read that ends in a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). Both are reachable by any node in the domain. Validate these fields right after dlm_grab(), before anything uses them -- including the not-joined error path, which already prints mres->lockname with the unbounded lockname_len as a %.*s precision. Reject the message unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <= DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the payload is large enough to hold the claimed locks. Conforming recovery and migration messages are unaffected.
References
Impacted products
Vendor Product Version
Linux Linux Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
Version: 6714d8e86bf443f6f7af50f9d432025649f091f5
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dlm/dlmrecovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4a5798253212093b9ff7d90c6cfbe348bcda1594",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "dce05b17db862f47ff60614017abe639b2e71cad",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "0e999d56917f861f97adb961617b1828c9eb4733",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "77686fa5bba135252d348e2dacf481fc19f60c41",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "f33041906885f96e190cde54e61ddc69de39e3ee",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "50c4cc9183e11f83427efbf770f54851f4471c02",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "a8facb1670b4a0612183198e758d9539ef628ed9",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "b54e03d9b3697d25f4a0063cf717d459c5e3ad94",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dlm/dlmrecovery.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate lengths in dlm_mig_lockres_handler\n\nA node receiving a DLM_MIG_LOCKRES message trusts several fields of the\npeer-supplied dlm_migratable_lockres without validation.  num_locks and\nlockname_len are bounded only on the sending side, and the message is\nnever checked to actually carry num_locks migratable_lock entries.  As a\nresult dlm_process_recovery_data() walks mres-\u003eml[0..num_locks) past the\nkmalloc(data_len) copy of the message (an out-of-bounds read that ends in\na BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the\nfixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). \nBoth are reachable by any node in the domain.\n\nValidate these fields right after dlm_grab(), before anything uses them --\nincluding the not-joined error path, which already prints mres-\u003elockname\nwith the unbounded lockname_len as a %.*s precision.  Reject the message\nunless lockname_len \u003c= DLM_LOCKID_NAME_MAX, num_locks \u003c=\nDLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the\npayload is large enough to hold the claimed locks.  Conforming recovery\nand migration messages are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - DLM_MIG_LOCKRES is received and dispatched by the ocfs2 o2net TCP cluster transport, so dlm_mig_lockres_handler() is reached through network protocol messages from a peer node.\nAC:L - A cluster peer can send a crafted DLM_MIG_LOCKRES with attacker-chosen lockname_len and num_locks; the heap overflow and BUG_ON are deterministic and require no race or other condition outside the attacker\u0027s control.\nPR:N - o2net gates peers by configured node IP, heartbeat, and the DLM domain key, with no user authentication or target-local privilege check before the handler runs, so exploitation needs no account on the victim.\nUI:N - Once the OCFS2/DLM domain is joined, exploitation is driven entirely by attacker-sent o2net messages and requires no victim user action such as mounting or opening a file.\nS:U - The heap corruption and resulting kernel impact remain within the same kernel and OCFS2 cluster-node security authority and do not cross a guest-to-host or IOMMU boundary.\nC:H - Unchecked lockname_len and num_locks produce a heap out-of-bounds write of attacker-controlled bytes and an out-of-bounds read past the kmalloc message copy, which can disclose adjacent kernel memory.\nI:H - dlm_init_lockres() memcpy()s up to 255 attacker-controlled bytes into a 32-byte o2dlm_lockname slab object, a heap out-of-bounds write that can overwrite adjacent objects and hijack kernel control flow.\nA:H - dlm_process_recovery_data() walks mres-\u003eml[] past the allocated message and hits BUG_ON, and the heap overflow can oops or panic the receiving node."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T08:47:45.937Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4a5798253212093b9ff7d90c6cfbe348bcda1594"
        },
        {
          "url": "https://git.kernel.org/stable/c/dce05b17db862f47ff60614017abe639b2e71cad"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e999d56917f861f97adb961617b1828c9eb4733"
        },
        {
          "url": "https://git.kernel.org/stable/c/77686fa5bba135252d348e2dacf481fc19f60c41"
        },
        {
          "url": "https://git.kernel.org/stable/c/f33041906885f96e190cde54e61ddc69de39e3ee"
        },
        {
          "url": "https://git.kernel.org/stable/c/50c4cc9183e11f83427efbf770f54851f4471c02"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8facb1670b4a0612183198e758d9539ef628ed9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b54e03d9b3697d25f4a0063cf717d459c5e3ad94"
        }
      ],
      "title": "ocfs2: validate lengths in dlm_mig_lockres_handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89494",
    "datePublished": "2026-09-11T19:43:45.455Z",
    "dateReserved": "2026-09-11T19:38:34.714Z",
    "dateUpdated": "2026-10-19T08:47:45.937Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.