{"id":"CVE-2026-89491","title":"kernel: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() (CVE-2026-89491)","summary":"A flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hb_region_pin…","severity":"medium","cvss":5.5,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvssSource":"vendor","cwe":"CWE-663","vendor":"Red Hat","product":"Linux","affected":["Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 3b790774280a610f8bdbd5d4260a07345bcf8e04","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 0cbc2f20a6ea7b4a59efa9171b7c694cdd196507","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < c9be4de77f97f383b750698e1517fd296041f4bb","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 49002acc520c61002ad195894ac391c94317d3ba","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < ce035f208d68b812d83e5482980f2b1c88a9cd94","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 470212a5eefabcc16b8e2f7fe2844b8737fe571c","Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < af09df89db9a68a1d76df0f75667998135bc8d65","Linux 2.6.38"],"published":"2026-09-11","updated":"2026-09-15","sourceUpdated":"2026-09-15T12:46:23+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89491.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89491.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-89491"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2532444"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-89491"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-89491"},{"url":"https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89491.mbox"},{"url":"https://git.kernel.org/stable/c/4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03"},{"url":"https://git.kernel.org/stable/c/3b790774280a610f8bdbd5d4260a07345bcf8e04"},{"url":"https://git.kernel.org/stable/c/0cbc2f20a6ea7b4a59efa9171b7c694cdd196507"},{"url":"https://git.kernel.org/stable/c/c9be4de77f97f383b750698e1517fd296041f4bb"},{"url":"https://git.kernel.org/stable/c/49002acc520c61002ad195894ac391c94317d3ba"},{"url":"https://git.kernel.org/stable/c/ce035f208d68b812d83e5482980f2b1c88a9cd94"},{"url":"https://git.kernel.org/stable/c/470212a5eefabcc16b8e2f7fe2844b8737fe571c"},{"url":"https://git.kernel.org/stable/c/af09df89db9a68a1d76df0f75667998135bc8d65"}],"tags":["csaf","vex","red-hat","cve.org"],"epss":0.0021,"epssPercentile":0.11527,"ingestedAt":"2026-09-14T15:23:07.452Z","slug":"CVE-2026-89491","body":"## Overview\n\nA flaw was found in the Linux kernel's ocfs2 cluster module. This vulnerability allows a local attacker to trigger a denial of service. The issue arises when a sleeping function is called while a spinlock is held within the o2hb_region_pin() function, which can lead to a system crash or deadlock. This can result in the affected system becoming unresponsive.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89491.json)\n\n**kernel: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()** — rated Moderate by Red Hat. Released 2026-09-11, updated 2026-09-15.\n\nNot affected:\n\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 6\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat OpenShift Container Platform 4\n\n## Remediation\n\nRefer to the advisory for fix availability.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":30.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":203885,"id":"CVE-2026-89491","ts":1789490210806,"field":"cvss","old":null,"new":"5.5"},{"seq":203884,"id":"CVE-2026-89491","ts":1789490210806,"field":"severity","old":"none","new":"medium"},{"seq":147207,"id":"CVE-2026-89491","ts":1789270201259,"field":"cvss","old":null,"new":"4.4"},{"seq":147206,"id":"CVE-2026-89491","ts":1789270201259,"field":"severity","old":"none","new":"medium"},{"seq":108958,"id":"CVE-2026-89491","ts":1789183729734,"field":"cvss","old":null,"new":"4.4"},{"seq":108957,"id":"CVE-2026-89491","ts":1789183729734,"field":"severity","old":"none","new":"medium"}]}