Executive brief
The Linux kernel's OCFS2 (Oracle Cluster File System) contains a use-after-free vulnerability in the debugfs locking state iterator. A debugfs reader can access freed memory when viewing lock information while another process simultaneously releases the same lock, potentially causing kernel crashes or information disclosure. This affects systems using OCFS2 with fsdlm stack.
Technical details
The vulnerability is a use-after-free (CWE-416) that occurs in the ocfs2_dlm_seq_show() function when dumping lock value block (LVB) data via debugfs. The root cause is that the locking_state debugfs iterator copies struct ocfs2_lock_res by value, but the copied sb_lvbptr field still points to memory in the original lockres owner. Between the time the lock is dropped and when the copied LVB data is read in ocfs2_dlm_lvb(), the original lockres container can be freed during teardown, leaving the pointer dangling. The attack vector is local; an attacker with debugfs read access can trigger the condition by concurrently accessing the locking_state file while another process frees the lockres. The fix rebases the copied sb_lvbptr to point to the inline LVB storage in the snapshot copy instead of the original freed memory.
Affected products
- Linux Linux kernel All versions with OCFS2 fsdlm support
Timeline
- 2026-08-15: disclosed
- patched: Fix available in Linux kernel to rebase copied sb_lvbptr