Linux Linux Kernel Vulnerability Exposed to Unauthenticated Network Attackers

Status: UPDATED  |  Advisory ID: CVE-2026-90301

Key Details

Affected Products, Subsystems & Sectors

What to Know

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: o2hb: quiesce negotiate handlers and timeout work

Heartbeat regions publish struct o2hb_region as the private data for the

NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()

creates the configfs region. The approve handler can call

o2hb_arm_timeout(), so a peer can touch the region timeout work before

dev_store() has finished building the heartbeat runtime, or after teardown

has started to shut that runtime back down.

The final configfs put also has to keep reg alive until the last in-flight

o2net callback drops its handler reference.

o2net_unregister_handler_list() blocks future handler lookups, but it does

not wait for sc_rx_work that already passed o2net_handler_get(). That

drain needs to cover local listener teardown as well, where the o2net

ordered workqueue may already be inside destroy_workqueue().

Fix the lifetime rule in both directions. Initialize the region delayed

works before publishing reg through the o2net handler table, keep new or

stopping regions non-armable with hr_stopping, and quiesce both delayed

works on failed-start and teardown paths even when no heartbeat thread is

left to call o2hb_disarm_timeout(). Then unregister handlers before

tearing down handler-visible region state and make the drain wait for the

active or destroying o2net ordered workqueue before release frees reg.

The buggy scenario involves two paths, with each column showing the order

within that path:

region lifecycle: late negotiate callback:

1. make_item() registers the 1. o2net_process_message() gets a

region handlers before heartbeat handler for reg.

dev_store() has built a 2. The callback runs after the lookup

runnable heartbeat context. lock is dropped and dereferences reg.

2. A failed start or rmdir 3. An approve or timeout path tries to

stops the heartbeat thread, queue reg's delayed work, or release

quiesces existing work, and races the callback body after handler

drops the final configfs ref. unregister.

3. region_release() must drain 4. The callback or delayed work can

handler-visible o2net rx work outlive reg unless lifecycle code

before freeing reg. keeps the region non-armable and

drains the active-or-destroying

o2net workqueue.

Validation reproduced this kernel report:

KASAN slab-use-after-free in __run_timers+0x22c/0x5b0

Write of size 8

Call trace:

dump_stack_lvl+0x66/0xa0

print_report+0xce/0x630

__run_timers+0x22c/0x5b0

kasan_report+0xe0/0x110

_raw_spin_unlock_irqrestore+0x27/0x60

try_to_wake_up+0x191/0xf70

timer_expire_remote+0xae/0xf0

run_timer_softirq+0x19b/0x1a0

handle_softirqs+0x156/0x660

__irq_exit_rcu+0xc4/0x160

irq_exit_rcu+0xe/0x20

sysvec_apic_timer_interrupt+0x6c/0x80

asm_sysvec_apic_timer_interrupt+0x1a/0x20

Allocated by task stack:

kasan_save_stack+0x33/0x60

kasan_save_track+0x14/0x30

__kasan_kmalloc+0xaa/0xb0

o2hb_heartbeat_group_make_item+0x3c/0x600 (NVD)

What to Do

Monitor Linux's web page for any future patch releases.

References