Executive brief
The Linux kernel's OCFS2 cluster file system has a race condition in its heartbeat teardown logic that can cause a crash or memory corruption. When a node is being shut down and the network layer is tearing down its work queue, concurrent heartbeat callbacks from other cluster nodes can attempt to queue work on an already-destroyed queue, causing the system to access freed memory. This can lead to kernel panics and service outages in OCFS2-based clustered storage environments.
Technical details
This is a use-after-free vulnerability in the OCFS2 cluster file system's heartbeat and o2net (OCFS2 networking) subsystems. The vulnerability occurs when heartbeat callbacks remain registered during local node teardown while o2net_wq (the network work queue) is being destroyed. A node-down event can race through o2net_disconnect_node() and o2net_set_nn_state() while the work queue is being freed, leading to __queue_work() attempting to queue on a dangling pointer. The attack vector requires kernel-level operation (local, teardown-induced race). KASAN detected this as a slab-use-after-free when reading from freed memory. The fix involves synchronizing heartbeat callbacks with transport state, marking the transport offline before destroying the work queue, and deferring node-up replay until the local node is published through o2nm_this_node().
Affected products
- Linux Linux kernel unspecified
Timeline
- 2026-09-17: disclosed
- 2026-09-17: patched: Patch series resolving the vulnerability with synchronization changes