Executive brief
The Linux kernel's ocfs2 (Oracle Cluster File System 2) component contains a locking bug where a sleeping function is called while holding a spinlock in the heartbeat region pinning code. This violates kernel locking semantics and can cause kernel panics on systems with atomic sleep debugging enabled, potentially leading to system instability or denial of service.
Technical details
The vulnerability is a lock ordering violation (spinlock sleep) in o2hb_region_pin() within the ocfs2 cluster heartbeat mechanism. The function is called while holding o2hb_live_lock (a spinlock), but then invokes o2nm_depend_item() → configfs_depend_item(), which sleeps by acquiring an inode rwsem and pinning the configfs filesystem. This triggers BUG_ON checks under CONFIG_DEBUG_ATOMIC_SLEEP. The fix reworks o2hb_region_pin() to drop o2hb_live_lock across each sleeping call, using config_item references to keep regions alive while unlocked. Additionally, the patch series fixes a lock inversion with configfs inode locks and an error handling bug where partial pins leak o2hb_dependent_users counters on failure.
Affected products
- Linux Linux kernel Affected versions not explicitly specified; fix introduced in patch series
Timeline
- 2026-09-11: disclosed: CVE published on NVD
- patched: Patches provided in series fixing o2hb_region_pin() and related error handling