Executive brief
The Linux kernel's Distributed Lock Manager (DLM) component, which enables multiple computers to coordinate access to shared resources, contains a flaw in how it orders network messages in a send queue. Under heavy load, this causes the system to lose track of message sequencing, leading to memory corruption and crashes. The vulnerability could allow a local attacker or malfunctioning network node to crash the system or potentially gain unauthorized access.
Technical details
This is a use-after-free vulnerability in the DLM midcomms layer (fs/dlm/midcomms.c) caused by improper ordering of message handles in the send queue. The root cause is a race condition where the message sequence number (mh->seq) is assigned after the message is added to the send queue with list_add_tail_rcu(), rather than before. The dlm_receive_ack function relies on ordered sequence numbers to safely iterate and dereference messages in the queue; when ordering is violated, stale references remain and are subsequently dereferenced. The vulnerability is triggered during high-throughput DLM request scenarios. The fix reorders the operations to assign the sequence number while holding the send_queue_lock, before the RCU list addition, ensuring consistency. Patches are available in the Linux stable tree.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 through 7.2 (see kernel.org stable tree)
Timeline
- 2026-08-15: disclosed: Vulnerability published in NVD
- 2026-04-27: patched: Upstream patch authored by Alexander Aring