CVE-2026-89494

The Linux kernel's ocfs2 distributed lock manager fails to validate the peer-supplied dlm_migratable_lockres structure when handling a DLM_MIG_LOCKRES message during lock-resource migration. A malicious node in an OCFS2 cluster domain can send a message with an oversized lockname_len or num_locks, causing dlm_init_lockres() to copy up to attacker-chosen lengths into a fixed 32-byte slab object (a heap out-of-bounds write with potential for kernel memory corruption or code execution), and dlm_process_recovery_data() to read past the allocated message copy (triggering a BUG_ON kernel panic). Exploitation requires the attacker to be a node in the cluster domain or able to inject traffic into the cluster's lock-management network, and it affects any Linux system using the ocfs2 clustered filesystem with the unpatched kernel. There is no public proof of concept and no indication of exploitation in the wild. Conforming recovery and migration messages continue to work after the fix, which validates lockname_len, num_locks, and the payload size immediately after dlm_grab().

What to do: Apply a kernel update containing the ocfs2 DLM validation fix as soon as your distribution ships it. If patching is delayed, restrict cluster lock-management and heartbeat traffic so only trusted cluster nodes can reach it (firewall the DLM communication ports from non-cluster hosts), and verify that unneeded systems are not running ocfs2 at all. Check whether the ocfs2/dlm modules are loaded or the filesystem is mounted on internet-reachable or multi-tenant hosts.