CVE-2026-89495

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: bound namelen in dlm_migrate_request_handler

Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm".

The o2dlm receive handlers trust u8 length and count fields from the wire

without bounding them, so a node in a DLM domain can corrupt or panic any

other node with a malformed message. Three defects:

- dlm_migrate_request_handler() passes migrate->namelen unchecked to

dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an

o2dlm_mle slab object: a heap out-of-bounds write of up to ~215

attacker-controlled bytes.

- dlm_mig_lockres_handler() passes mres->lockname_len unchecked to

dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname

slab object: a heap out-of-bounds write of up to ~223 bytes.

- the same handler trusts mres->num_locks without checking that the

message is large enough to hold that many entries, so

dlm_process_recovery_d

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References