CVE-2026-90322 (GCVE-0-2026-90322)
Vulnerability from cvelistv5
Published
2026-09-17 16:08
Modified
2026-10-21 12:50
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nm_node_local_store() handles local=0 by stopping o2net and setting cl_local_node to O2NM_INVALID_NODE_NUM, but it leaves cl_has_local set. That stale state makes o2nm_this_node() return 255, blocks a later local=1 attempt with -EBUSY, and can feed 255 to heartbeat users that call o2nm_this_node() dynamically. Clearing cl_has_local is required when the local node is reset. But heartbeat threads can still be running at that point. They pin the local node config item at startup, yet o2hb_do_disk_heartbeat() and thread teardown re-read o2nm_this_node() for the local slot and for o2nm_undepend_this_node(). Once local=0 has cleared the live local-node state, those dynamic reads return O2NM_MAX_NODES, which is also the invalid node number 255. Store the local node number in the heartbeat region when the region starts. Use that stable node for heartbeat slot writes/checks, negotiation messages, and the final configfs undepend. Stop the heartbeat loop when the current local node no longer matches the stored node, and clear cl_has_local together with cl_local_node in the local=0 path so nodemanager state matches node removal. Validation reproduced this kernel report: KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372/0xb30 RIP: 0010:memset+0xf/0x20 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xd0/0x630 o2hb_do_disk_heartbeat+0x372/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x188/0x2f0 kasan_report+0xe4/0x120 o2hb_do_disk_heartbeat+0x5/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) o2hb_thread+0x14e/0x770 kthread_affine_node+0x139/0x180 lockdep_hardirqs_on_prepare+0xda/0x190 trace_hardirqs_on+0x18/0x130 kthread+0x19d/0x1e0 ret_from_fork+0x37a/0x4d0 __switch_to+0x2d5/0x6f0 ret_from_fork_asm+0x1a/0x30
References
Impacted products
Vendor Product Version
Linux Linux Version: a7f6a5fb4bde142b622706e2006ba33f793e13ed
Version: a7f6a5fb4bde142b622706e2006ba33f793e13ed
Version: a7f6a5fb4bde142b622706e2006ba33f793e13ed
Version: a7f6a5fb4bde142b622706e2006ba33f793e13ed
Version: a7f6a5fb4bde142b622706e2006ba33f793e13ed
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/nodemanager.c",
            "fs/ocfs2/cluster/nodemanager.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d64708cc119db01fbc55017ee6e987b680ebd59c",
              "status": "affected",
              "version": "a7f6a5fb4bde142b622706e2006ba33f793e13ed",
              "versionType": "git"
            },
            {
              "lessThan": "8e5cb90f212fda9f6cd29915a1ed74353108ceb3",
              "status": "affected",
              "version": "a7f6a5fb4bde142b622706e2006ba33f793e13ed",
              "versionType": "git"
            },
            {
              "lessThan": "8abb2b7c60d2b2c0f40606048c873096c03874d2",
              "status": "affected",
              "version": "a7f6a5fb4bde142b622706e2006ba33f793e13ed",
              "versionType": "git"
            },
            {
              "lessThan": "70d7bb7a0be033e5ebe8a2c48974692b1318891c",
              "status": "affected",
              "version": "a7f6a5fb4bde142b622706e2006ba33f793e13ed",
              "versionType": "git"
            },
            {
              "lessThan": "688bc88e2046dd6ce81ce18079b5254cb8dadc0e",
              "status": "affected",
              "version": "a7f6a5fb4bde142b622706e2006ba33f793e13ed",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/nodemanager.c",
            "fs/ocfs2/cluster/nodemanager.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.160",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.160",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.110",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.52",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/cluster: keep heartbeat local node stable\n\no2nm_node_local_store() handles local=0 by stopping o2net and setting\ncl_local_node to O2NM_INVALID_NODE_NUM, but it leaves cl_has_local set. \nThat stale state makes o2nm_this_node() return 255, blocks a later local=1\nattempt with -EBUSY, and can feed 255 to heartbeat users that call\no2nm_this_node() dynamically.\n\nClearing cl_has_local is required when the local node is reset.  But\nheartbeat threads can still be running at that point.  They pin the local\nnode config item at startup, yet o2hb_do_disk_heartbeat() and thread\nteardown re-read o2nm_this_node() for the local slot and for\no2nm_undepend_this_node().  Once local=0 has cleared the live local-node\nstate, those dynamic reads return O2NM_MAX_NODES, which is also the\ninvalid node number 255.\n\nStore the local node number in the heartbeat region when the region\nstarts.  Use that stable node for heartbeat slot writes/checks,\nnegotiation messages, and the final configfs undepend.  Stop the heartbeat\nloop when the current local node no longer matches the stored node, and\nclear cl_has_local together with cl_local_node in the local=0 path so\nnodemanager state matches node removal.\n\nValidation reproduced this kernel report:\nKASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372/0xb30\nRIP: 0010:memset+0xf/0x20\nRead of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xd0/0x630\n  o2hb_do_disk_heartbeat+0x372/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x188/0x2f0\n  kasan_report+0xe4/0x120\n  o2hb_do_disk_heartbeat+0x5/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)\n  o2hb_thread+0x14e/0x770\n  kthread_affine_node+0x139/0x180\n  lockdep_hardirqs_on_prepare+0xda/0x190\n  trace_hardirqs_on+0x18/0x130\n  kthread+0x19d/0x1e0\n  ret_from_fork+0x37a/0x4d0\n  __switch_to+0x2d5/0x6f0\n  ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-21T12:50:57.872Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d64708cc119db01fbc55017ee6e987b680ebd59c"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e5cb90f212fda9f6cd29915a1ed74353108ceb3"
        },
        {
          "url": "https://git.kernel.org/stable/c/8abb2b7c60d2b2c0f40606048c873096c03874d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/70d7bb7a0be033e5ebe8a2c48974692b1318891c"
        },
        {
          "url": "https://git.kernel.org/stable/c/688bc88e2046dd6ce81ce18079b5254cb8dadc0e"
        }
      ],
      "title": "ocfs2/cluster: keep heartbeat local node stable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90322",
    "datePublished": "2026-09-17T16:08:38.768Z",
    "dateReserved": "2026-09-11T19:38:34.802Z",
    "dateUpdated": "2026-10-21T12:50:57.872Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.