Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

Linux kernel OCFS2 lock manager can cause crashes

CVE-2026-89495 · published 1 month ago
Summary

The OCFS2 distributed lock manager in the Linux kernel does not check the size of certain messages it receives. A compromised or misbehaving node can send specially crafted data that overwrites memory, potentially causing the affected system to freeze or restart. Apply the latest kernel updates that add proper size checks to stop this behavior.

What to do
  • Update debian linux to version 7.2.6-1.
  • Update linux kernel to version 7.2.4.
  • Update bellsoft linux-lts to version 6.18.53-r0.
  • Update debian linux to version 6.12.111-1.
  • Update bellsoft linux-lts to version 6.12.111-r0.
  • Update debian linux-6.12 to version 6.12.111-1~deb12u1.
  • Update bellsoft linux-lts to version 6.1.189-r0.
  • Update linux linux to version f8658ee3327f73bd81c0bcd07cdeb5a8527fac98 or later.
Affected software
Ecosystem VendorProductAffected versions
Debian:12 debian linux All versions
Debian:14 debian linux < 7.2.6-1
Fix: upgrade to 7.2.6-1
– linux linux < f8658ee3327f73bd81c0bcd07cdeb5a8527fac98
2.6.16
Linux linux kernel >= 6.19.0, < 7.2.4
Fix: upgrade to 7.2.4
Ubuntu:Pro:14.04:LTS canonical linux All versions
Ubuntu:Pro:14.04:LTS canonical linux-aws All versions
Ubuntu:Pro:14.04:LTS canonical linux-azure All versions
Ubuntu:Pro:14.04:LTS canonical linux-lts-xenial All versions
Ubuntu:Pro:16.04:LTS canonical linux-aws-hwe All versions
Ubuntu:Pro:16.04:LTS canonical linux-gcp All versions
Ubuntu:Pro:16.04:LTS canonical linux-hwe All versions
Ubuntu:16.04:LTS canonical linux-hwe-edge All versions
Ubuntu:Pro:16.04:LTS canonical linux-kvm All versions
Ubuntu:Pro:16.04:LTS canonical linux-oracle All versions
Ubuntu:Pro:FIPS:16.04:LTS canonical linux-fips All versions
Ubuntu:18.04:LTS canonical linux-aws-5.0 All versions
Ubuntu:18.04:LTS canonical linux-aws-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-aws-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-4.15 All versions
Ubuntu:18.04:LTS canonical linux-azure-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-azure-5.4 All versions
Ubuntu:18.04:LTS canonical linux-azure-edge All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gcp-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-gcp-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gke-4.15 All versions
Ubuntu:18.04:LTS canonical linux-gke-5.4 All versions
Ubuntu:18.04:LTS canonical linux-gkeop-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-hwe-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-ibm-5.4 All versions
Ubuntu:18.04:LTS canonical linux-oem All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.0 All versions
Ubuntu:18.04:LTS canonical linux-oracle-5.3 All versions
Ubuntu:Pro:18.04:LTS canonical linux-oracle-5.4 All versions
Ubuntu:Pro:18.04:LTS canonical linux-raspi-5.4 All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-aws-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-azure-fips All versions
Ubuntu:Pro:FIPS-updates:18.04:LTS canonical linux-gcp-fips All versions
Ubuntu:20.04:LTS canonical linux-aws-5.11 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-aws-5.15 All versions
Ubuntu:20.04:LTS canonical linux-aws-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.11 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-5.15 All versions
Ubuntu:20.04:LTS canonical linux-azure-5.8 All versions
Ubuntu:20.04:LTS canonical linux-azure-fde All versions
Ubuntu:Pro:20.04:LTS canonical linux-azure-fde-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-bluefield All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.11 All versions
Showing 50 of 178. Show the rest
Ecosystem VendorProductAffected versions
Ubuntu:20.04:LTS canonical linux-gcp-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-gcp-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gcp-5.8 All versions
Ubuntu:20.04:LTS canonical linux-gke All versions
Ubuntu:20.04:LTS canonical linux-gke-5.15 All versions
Ubuntu:20.04:LTS canonical linux-gkeop All versions
Ubuntu:20.04:LTS canonical linux-gkeop-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.11 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-hwe-5.15 All versions
Ubuntu:20.04:LTS canonical linux-hwe-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm All versions
Ubuntu:Pro:20.04:LTS canonical linux-ibm-5.15 All versions
Ubuntu:20.04:LTS canonical linux-intel-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-intel-iotg-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-iot All versions
Ubuntu:Pro:20.04:LTS canonical linux-lowlatency-hwe-5.15 All versions
Ubuntu:Pro:20.04:LTS canonical linux-nvidia-tegra-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.10 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.13 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.14 All versions
Ubuntu:20.04:LTS canonical linux-oem-5.6 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.11 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.13 All versions
Ubuntu:Pro:20.04:LTS canonical linux-oracle-5.15 All versions
Ubuntu:20.04:LTS canonical linux-oracle-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-raspi All versions
Ubuntu:20.04:LTS canonical linux-raspi2 All versions
Ubuntu:20.04:LTS canonical linux-riscv All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.11 All versions
Ubuntu:Pro:20.04:LTS canonical linux-riscv-5.15 All versions
Ubuntu:20.04:LTS canonical linux-riscv-5.8 All versions
Ubuntu:Pro:20.04:LTS canonical linux-xilinx-zynqmp All versions
Ubuntu:22.04:LTS canonical linux-allwinner-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-5.19 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.2 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.5 All versions
Ubuntu:22.04:LTS canonical linux-aws-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.5 All versions
Ubuntu:22.04:LTS canonical linux-azure-6.8 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-5.19 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.2 All versions
Ubuntu:22.04:LTS canonical linux-azure-fde-6.8 All versions
Ubuntu:22.04:LTS canonical linux-gcp-5.19 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.2 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.5 All versions
Ubuntu:22.04:LTS canonical linux-gcp-6.8 All versions
Ubuntu:22.04:LTS canonical linux-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-ibm-6.8 All versions
Ubuntu:22.04:LTS canonical linux-intel-iot-realtime All versions
Ubuntu:22.04:LTS canonical linux-intel-iotg All versions
Ubuntu:22.04:LTS canonical linux-lowlatency All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-5.19 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.2 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.5 All versions
Ubuntu:22.04:LTS canonical linux-lowlatency-hwe-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.2 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.5 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-6.8 All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra All versions
Ubuntu:22.04:LTS canonical linux-nvidia-tegra-igx All versions
Ubuntu:22.04:LTS canonical linux-oem-5.17 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.0 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.1 All versions
Ubuntu:22.04:LTS canonical linux-oem-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.5 All versions
Ubuntu:22.04:LTS canonical linux-oracle-6.8 All versions
Ubuntu:22.04:LTS canonical linux-realtime All versions
Ubuntu:22.04:LTS canonical linux-riscv-5.19 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.5 All versions
Ubuntu:22.04:LTS canonical linux-riscv-6.8 All versions
Ubuntu:22.04:LTS canonical linux-starfive-5.19 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.2 All versions
Ubuntu:22.04:LTS canonical linux-starfive-6.5 All versions
Ubuntu:Pro:Realtime:22.04:LTS canonical linux-realtime-6.8 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.14 All versions
Ubuntu:24.04:LTS canonical linux-aws-6.17 All versions
Ubuntu:24.04:LTS canonical linux-aws-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.11 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.14 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-6.17 All versions
Ubuntu:24.04:LTS canonical linux-azure-fde-7.0 All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia All versions
Ubuntu:24.04:LTS canonical linux-azure-nvidia-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.11 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.14 All versions
Ubuntu:24.04:LTS canonical linux-gcp-6.17 All versions
Ubuntu:24.04:LTS canonical linux-gcp-7.0 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.14 All versions
Ubuntu:24.04:LTS canonical linux-hwe-6.17 All versions
Ubuntu:24.04:LTS canonical linux-hwe-7.0 All versions
Ubuntu:24.04:LTS canonical linux-lowlatency-hwe-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.11 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-6.17 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-7.0 All versions
Ubuntu:24.04:LTS canonical linux-nvidia-lowlatency All versions
Ubuntu:24.04:LTS canonical linux-oem-6.11 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oem-6.8 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.14 All versions
Ubuntu:24.04:LTS canonical linux-oracle-6.17 All versions
Ubuntu:24.04:LTS canonical linux-oracle-7.0 All versions
Ubuntu:24.04:LTS canonical linux-raspi-realtime All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.14 All versions
Ubuntu:24.04:LTS canonical linux-riscv-6.17 All versions
Ubuntu:24.04:LTS canonical linux-riscv-7.0 All versions
Ubuntu:24.04:LTS canonical linux-xilinx All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.14 All versions
Ubuntu:Pro:Realtime:24.04:LTS canonical linux-realtime-6.17 All versions
Ubuntu:26.04:LTS canonical linux-nvidia-bos All versions
Ubuntu:26.04:LTS canonical linux-oem-7.0 All versions
Alpaquita:23 bellsoft linux-lts >= 6.1.182-r0
>= 6.1.182-r0, < 6.1.189-r0
Fix: upgrade to 6.1.189-r0
Alpaquita:25 bellsoft linux-lts >= 6.12.103-r0
>= 6.12.103-r0, < 6.12.111-r0
Fix: upgrade to 6.12.111-r0
Alpaquita:stream bellsoft linux-lts >= 6.18.46-r0
>= 6.18.46-r0, < 6.18.53-r0
Fix: upgrade to 6.18.53-r0
Debian:13 debian linux < 6.12.111-1
Fix: upgrade to 6.12.111-1
Debian:12 debian linux-6.12 < 6.12.111-1~deb12u1
Fix: upgrade to 6.12.111-1~deb12u1
Ubuntu:24.04:LTS canonical linux-vmware All versions
Original advisory text
BELL-CVE-2026-89495
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in a DLM domain can corrupt or panic any other node with a malformed message. Three defects: - dlm_migrate_request_handler() passes migrate->namelen unchecked to dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an o2dlm_mle slab object: a heap out-of-bounds write of up to ~215 attacker-controlled bytes. - dlm_mig_lockres_handler() passes mres->lockname_len unchecked to dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname slab object: a heap out-of-bounds write of up to ~223 bytes. - the same handler trusts mres->num_locks without checking that the message is large enough to hold that many entries, so dlm_process_recovery_data() walks mres->ml[] past the kmalloc(data_len) copy and trips a BUG_ON (an out-of-bounds read ending in a panic). The other o2dlm receive handlers already reject an oversized name; the migration and recovery handlers have omitted it since the DLM was added (see the Fixes tags). Patch 1 bounds namelen; patch 2 validates lockname_len, num_locks, and the payload size. Conforming recovery and migration traffic is unaffected. o2net authenticates peers only by the DLM domain key, so any node that has joined the domain -- including a compromised or malicious member -- can send these messages. There is no local trigger; the attacker must already be a member of the cluster. Each sink was confirmed under KASAN with an out-of-tree module mirroring it exactly -- a kmem_cache/kmalloc of the real destination size, then the same unclamped memcpy/loop: slab-out-of-bounds Write for the two writes, Read for the recovery walk, and a panic. A userspace AddressSanitizer build faults identically under -m32 and -m64. Scrubbed logs are available on request. I reported this privately to [email protected] and the ocfs2 maintainers on 2026-06-20; with no response after the standard embargo period I am posting the fix publicly. I have no embargo requirement. This patch (of 2): A node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied name length (migrate->namelen) without bounding it. dlm_init_mle() then copies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[] array of an o2dlm_mle slab object, so a malformed message from a cluster peer overflows the slab object by up to ~215 bytes: a heap out-of-bounds write of attacker-controlled data, reachable by any node in the domain. Reject an oversized name, the way dlm_master_request_handler() and the other o2dlm receive handlers already do; the migration handler omits the check entirely. Conforming messages are unaffected.
References
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Timeline
Published11 Sep 2026
Updated12 Oct 2026
First seen11 Sep 2026
Sources
CVE-2026-89495 · NVD
CVE-2026-89495 · MITRE
DEBIAN-CVE-2026-89495 · OSV
CVE-2026-89495 · OSV
UBUNTU-CVE-2026-89495 · OSV
BELL-CVE-2026-89495 · OSV
Track software like this
Free during beta