Executive brief
The Linux kernel's ocfs2 heartbeat subsystem contains a race condition that allows freed memory to be accessed. When heartbeat regions are torn down, network callbacks and timeout work can reference the freed region structure, leading to kernel crashes. This affects systems using ocfs2 clustering and can be exploited by local attackers to cause denial of service.
Technical details
This is a use-after-free vulnerability in the ocfs2 o2hb (heartbeat) subsystem triggered by a race condition in region lifetime management. The vulnerable component publishes the o2hb_region structure to o2net handlers before the heartbeat runtime is fully initialized, and during teardown, in-flight o2net callbacks and delayed work (timeout/approve handlers) can reference the region after configfs has freed it. The attack requires local access to trigger configfs region creation/destruction and negotiate with a peer node to race the handlers. An attacker can achieve kernel memory corruption, causing DoS via KASAN-reported use-after-free crashes in timer code. The fix involves marking regions non-armable during lifecycle transitions, quiescing delayed work before release, and draining the o2net ordered workqueue before freeing the region structure.
Affected products
- Linux Linux kernel multiple
Timeline
- 2026-09-17: disclosed