{"id":"CVE-2026-89494","title":"ocfs2: validate lengths in dlm_mig_lockres_handler","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate lengths in dlm_mig_lockres_handler\n\nA node receiving a DLM_MIG_LOCKRES message trusts several fields of the\npeer-supplied dlm_migratable_lockres without…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 4a5798253212093b9ff7d90c6cfbe348bcda1594","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < dce05b17db862f47ff60614017abe639b2e71cad","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 0e999d56917f861f97adb961617b1828c9eb4733","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 77686fa5bba135252d348e2dacf481fc19f60c41","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < f33041906885f96e190cde54e61ddc69de39e3ee","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 50c4cc9183e11f83427efbf770f54851f4471c02","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < a8facb1670b4a0612183198e758d9539ef628ed9","Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < b54e03d9b3697d25f4a0063cf717d459c5e3ad94","Linux 2.6.16"],"published":"2026-09-11","updated":"2026-09-14","sourceUpdated":"2026-09-14T12:00:28.925Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-89494","references":[{"url":"https://git.kernel.org/stable/c/4a5798253212093b9ff7d90c6cfbe348bcda1594"},{"url":"https://git.kernel.org/stable/c/dce05b17db862f47ff60614017abe639b2e71cad"},{"url":"https://git.kernel.org/stable/c/0e999d56917f861f97adb961617b1828c9eb4733"},{"url":"https://git.kernel.org/stable/c/77686fa5bba135252d348e2dacf481fc19f60c41"},{"url":"https://git.kernel.org/stable/c/f33041906885f96e190cde54e61ddc69de39e3ee"},{"url":"https://git.kernel.org/stable/c/50c4cc9183e11f83427efbf770f54851f4471c02"},{"url":"https://git.kernel.org/stable/c/a8facb1670b4a0612183198e758d9539ef628ed9"},{"url":"https://git.kernel.org/stable/c/b54e03d9b3697d25f4a0063cf717d459c5e3ad94"}],"tags":["cve.org"],"epss":0.00704,"epssPercentile":0.51875,"ingestedAt":"2026-09-14T15:23:07.452Z","slug":"CVE-2026-89494","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: validate lengths in dlm_mig_lockres_handler\n\nA node receiving a DLM_MIG_LOCKRES message trusts several fields of the\npeer-supplied dlm_migratable_lockres without validation.  num_locks and\nlockname_len are bounded only on the sending side, and the message is\nnever checked to actually carry num_locks migratable_lock entries.  As a\nresult dlm_process_recovery_data() walks mres->ml[0..num_locks) past the\nkmalloc(data_len) copy of the message (an out-of-bounds read that ends in\na BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the\nfixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). \nBoth are reachable by any node in the domain.\n\nValidate these fields right after dlm_grab(), before anything uses them --\nincluding the not-joined error path, which already prints mres->lockname\nwith the unbounded lockname_len as a %.*s precision.  Reject the message\nunless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <=\nDLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the\npayload is large enough to hold the claimed locks.  Conforming recovery\nand migration messages are unaffected.\n\n## Affected\n\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 4a5798253212093b9ff7d90c6cfbe348bcda1594`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < dce05b17db862f47ff60614017abe639b2e71cad`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 0e999d56917f861f97adb961617b1828c9eb4733`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 77686fa5bba135252d348e2dacf481fc19f60c41`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < f33041906885f96e190cde54e61ddc69de39e3ee`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < 50c4cc9183e11f83427efbf770f54851f4471c02`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < a8facb1670b4a0612183198e758d9539ef628ed9`\n- `Linux >= 6714d8e86bf443f6f7af50f9d432025649f091f5 < b54e03d9b3697d25f4a0063cf717d459c5e3ad94`\n- `Linux 2.6.16`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":54,"depthScoreParts":{"impact":53.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[{"seq":198008,"id":"CVE-2026-89494","ts":1789384321353,"field":"cvss","old":"6.6","new":"9.8"},{"seq":198007,"id":"CVE-2026-89494","ts":1789384321353,"field":"severity","old":"medium","new":"critical"},{"seq":183785,"id":"CVE-2026-89494","ts":1789356677377,"field":"cvss","old":"9.8","new":"6.6"},{"seq":183784,"id":"CVE-2026-89494","ts":1789356677377,"field":"severity","old":"critical","new":"medium"},{"seq":153282,"id":"CVE-2026-89494","ts":1789285349873,"field":"cvss","old":null,"new":"9.8"},{"seq":153281,"id":"CVE-2026-89494","ts":1789285349873,"field":"severity","old":"none","new":"critical"},{"seq":109652,"id":"CVE-2026-89494","ts":1789183732798,"field":"cvss","old":null,"new":"6.6"},{"seq":109651,"id":"CVE-2026-89494","ts":1789183732798,"field":"severity","old":"none","new":"medium"}]}