Executive brief
A vulnerability in the Linux kernel's OCFS2 distributed lock manager allows a use-after-free memory error when accessing debugfs files after a domain has been unregistered. An attacker with local access to the system could exploit this to trigger a kernel crash or potentially execute arbitrary code, affecting system stability and availability.
Technical details
The vulnerability is a use-after-free in the ocfs2/dlm debugfs layer caused by improper reference counting. The debug_lockres_open() function calls dlm_grab() to acquire a reference to the dlm_ctxt but ignores the return value; when dlm_grab() returns NULL (after domain unregistration), the pointer is still stored and later dereferenced in debug_lockres_release(), leading to a kernel panic. The race occurs when a domain unregisters and frees the dlm_ctxt while a debugfs file descriptor remains open. The fix requires debug_lockres_open() to check dlm_grab()'s return value and fail the open operation if the reference cannot be acquired, preventing the subsequent use-after-free in the release path.
Affected products
- Linux Linux kernel Multiple versions prior to fix
Timeline
- 2026-08-15: disclosed
- 2026-08-15: patched: Fix applied: debug_lockres_open() now checks dlm_grab() return value and fails gracefully