CVE-2026-89494

Status: UPDATED  |  Advisory ID: CVE-2026-89494

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate lengths in dlm_mig_lockres_handler

A node receiving a DLM_MIG_LOCKRES message trusts several fields of the

peer-supplied dlm_migratable_lockres without validation. num_locks and

lockname_len are bounded only on the sending side, and the message is

never checked to actually carry num_locks migratable_lock entries. As a

result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the

kmalloc(data_len) copy of the message (an out-of-bounds read that ends in

a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the

fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write).

Both are reachable by any node in the domain.

Validate these fields right after dlm_grab(), before anything uses them --

including the not-joined error path, which already prints mres->lockname

with the unbounded lockname_len as a %.*s precision. Reject the message

unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <=

DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the

payload is large enough to hold the claimed locks. Conforming recovery

and migration messages are unaffected. (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References