Executive brief
A flaw in the Linux kernel's OCFS2 clustered filesystem module fails to validate message fields when processing distributed lock manager (DLM) migration messages from peer cluster nodes. An attacker with access to a cluster node can send specially crafted messages to trigger heap buffer overflow and out-of-bounds memory reads, potentially causing system crashes or enabling arbitrary code execution on affected systems.
Technical details
The vulnerability exists in the dlm_mig_lockres_handler function in fs/ocfs2/dlm/dlmrecovery.c, which processes DLM_MIG_LOCKRES messages received from peer nodes in an OCFS2 cluster domain. The handler trusts untrusted fields (lockname_len and num_locks) from the peer-supplied dlm_migratable_lockres structure without proper validation, leading to two distinct memory safety issues: (1) a heap out-of-bounds write when dlm_init_lockres() copies lockname_len bytes into a fixed 32-byte o2dlm_lockname slab object, and (2) an out-of-bounds read when dlm_process_recovery_data() walks past the allocated message buffer. The attack requires network access to a cluster node and the ability to send DLM messages; no authentication is required beyond cluster domain membership. The fix validates lockname_len, num_locks, and message payload size immediately after dlm_grab() before any untrusted data is used. Patches are available in the Linux stable tree.
Affected products
- Linux Linux kernel Unspecified (all versions with OCFS2 DLM support prior to patched versions)
Timeline
- 2026-09-11: disclosed: CVE-2026-89494 published by NVD
- 2026-09-14: patched: Patches merged into Linux stable tree (commit 0e999d56917f861f97adb961617b1828c9eb4733 and others)
- 2026-06-29: other: Fix authored by Bryam Vargas