CVE-2026-90301

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: o2hb: quiesce negotiate handlers and timeout work

Heartbeat regions publish struct o2hb_region as the private data for the

NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()

creates the configfs region. The approve handler can call

o2hb_arm_timeout(), so a peer can touch the region timeout work before

dev_store() has finished building the heartbeat runtime, or after teardown

has started to shut that runtime back down.

The final configfs put also has to keep reg alive until the last in-flight

o2net callback drops its handler reference.

o2net_unregister_handler_list() blocks future handler lookups, but it does

not wait for sc_rx_work that already passed o2net_handler_get(). That

drain needs to cover local listener teardown as well, where the o2net

ordered workqueue may already be inside destroy_workqueue().

Fix the lifetime rule in both directions. Initialize the region delayed

works befor

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References