Executive brief
The Linux kernel's OCFS2 clustered file system contains a flaw in its distributed lock manager (DLM) that allows any cluster member to crash or corrupt other nodes by sending a malformed message with an oversized name length. This affects deployments using OCFS2 for shared storage or clustered applications, potentially causing service outages or data corruption.
Technical details
The vulnerability is a heap out-of-bounds write in the OCFS2 DLM message handler. Specifically, dlm_migrate_request_handler() trusts an unchecked u8 namelen field from a peer-supplied DLM_MIGRATE_REQUEST message and passes it directly to dlm_init_mle(), which memcpy()s up to ~215 attacker-controlled bytes into a fixed 32-byte mname[] array in an o2dlm_mle slab object. The attack vector is network-based within a cluster domain; any authenticated cluster member can trigger this without additional privileges. The attacker can achieve arbitrary heap corruption, leading to memory disclosure, denial of service (panic), or potential code execution. Patches add bounds checking on the namelen field, matching the validation already present in dlm_master_request_handler().
Affected products
- Linux Linux kernel all versions (omitted check since DLM addition)
Timeline
- 2026-06-20: disclosed: Private disclosure to security@kernel.org and OCFS2 maintainers
- 2026-09-11: advisory: Public disclosure after standard embargo period with no response
- 2026-09-11: other: CVE-2026-89495 assigned