Executive brief
A vulnerability was identified in the Linux kernel's OCFS2 file system component, which manages shared storage in clustered environments. An attacker could send a specially crafted network message to trigger an out-of-bounds memory read. This could lead to system instability or the exposure of sensitive information from the kernel's memory.
Technical details
A vulnerability exists in the dlm_match_regions() function within the OCFS2 Distributed Lock Manager (DLM) of the Linux kernel. The root cause is a lack of bounds checking on the 'qr_numregions' field received in a DLM_QUERY_REGION network message. While the o2net layer validates the total message length, it does not constrain the 'qr_numregions' value, which is used as a loop bound to iterate over the 'qr_regions' buffer. Because 'qr_regions' is fixed to O2NM_MAX_REGIONS (32) entries, a crafted message with a larger value (up to 255) triggers out-of-bounds reads. Additionally, an off-by-one error in the comparison loop ('<=' instead of '<') further contributes to improper memory access. This can be exploited by a network-adjacent attacker to cause a denial of service or potentially leak kernel memory. Patches have been released to enforce O2NM_MAX_REGIONS bounds and correct the loop logic.
Affected products
- Linux Linux Kernel ea2034416b54700e30371f2ad6517cbb94674083
Timeline
- 2026-06-24: disclosed: CVE published to NVD
- 2026-06-01: patched: Committed to stable kernel tree
References
- https://git.kernel.org/stable/c/1f8b91275912cd428289c1fb424bebd7ff5302bd
- https://git.kernel.org/stable/c/3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21
- https://git.kernel.org/stable/c/3f474c33ebc2e2ca3fcb587d7de4375348f13373
- https://git.kernel.org/stable/c/6c6e8fc3c007319981647b410c29bb5775048551
- https://git.kernel.org/stable/c/7ab3fbb01bc6d79091bc375e5235d360cd9b78be
- https://git.kernel.org/stable/c/d3d5efade0c79dac1cac98c0cb1115432f804439
- https://git.kernel.org/stable/c/f37de46149db49abd2b24f4f0c5a88cf4dfb5f47