CVE-2026-89494

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate lengths in dlm_mig_lockres_handler

A node receiving a DLM_MIG_LOCKRES message trusts several fields of the

peer-supplied dlm_migratable_lockres without validation. num_locks and

lockname_len are bounded only on the sending side, and the message is

never checked to actually carry num_locks migratable_lock entries. As a

result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the

kmalloc(data_len) copy of the message (an out-of-bounds read that ends in

a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the

fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write).

Both are reachable by any node in the domain.

Validate these fields right after dlm_grab(), before anything uses them --

including the not-joined error path, which already prints mres->lockname

with the unbounded lockname_len as a %.*s precision. Reject the message

unless lockname_len <= DLM_LOC

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References