CVE-2026-43125: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-43125 Overview

CVE-2026-43125 is a Linux kernel vulnerability in the Distributed Lock Manager (DLM) subsystem. The flaw resides in the dlm_search_rsb_tree() function, where the len parameter passed to dlm_dump_rsb_name() is not validated. The length value originates from network messages, allowing a remote source to control it. When the supplied length exceeds DLM_RESNAME_MAXLEN, the kernel performs an out-of-bounds write. The upstream fix introduces explicit length validation before the buffer write occurs.

Critical Impact

Network-supplied length values can trigger an out-of-bounds write in kernel memory, leading to potential memory corruption, kernel panics, or denial of service in clustered Linux environments using DLM.

Affected Products

• Linux kernel versions containing the unpatched dlm_search_rsb_tree() implementation
• Distributions deploying DLM for clustered file systems such as GFS2 and OCFS2
• Server clusters that exchange DLM messages over the network

Discovery Timeline

• 2026-05-06 - CVE-2026-43125 published to NVD
• 2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43125

Vulnerability Analysis

The Linux kernel DLM subsystem coordinates locking across nodes in a cluster. Nodes exchange resource state through network messages that include a resource name and its length. The function dlm_dump_rsb_name() accepts a len parameter sourced from these network messages and passes it into dlm_search_rsb_tree() without bounds checking.

When len exceeds the constant DLM_RESNAME_MAXLEN, the downstream code writes past the end of the destination buffer. This produces an out-of-bounds write [CWE-787] in kernel space. Successful exploitation can corrupt adjacent kernel data structures, destabilize the cluster node, or create conditions for further memory-safety abuse.

The upstream patch resolves the issue by validating the length before the buffer write, rejecting any value greater than DLM_RESNAME_MAXLEN. Fix commits include 080e5563f878, 082083c9fbd9, 5f053a2e7209, and 67288113c5e6.

Root Cause

The root cause is missing input validation on a length field that crosses a trust boundary. Network-derived data is treated as bounded without any check that it actually fits inside the kernel buffer. The DLM message handler must enforce that lock resource names cannot exceed DLM_RESNAME_MAXLEN.

Attack Vector

An attacker capable of sending DLM protocol messages to a target cluster node can craft a packet containing an oversized length field. Because DLM communication occurs between trusted cluster peers, the practical attack surface depends on network segmentation. A compromised cluster member, a host with access to the cluster interconnect, or a misconfigured network exposing DLM ports can deliver the malicious message. See the Linux kernel patch commit for technical details on the fix path.

Detection Methods for CVE-2026-43125

Indicators of Compromise

• Unexpected kernel oops or panic messages referencing dlm_search_rsb_tree or dlm_dump_rsb_name in dmesg or /var/log/messages
• Cluster node reboots or fencing events correlated with inbound DLM traffic on TCP/SCTP port 21064
• Malformed DLM protocol messages observed by network monitoring on cluster interconnects

Detection Strategies

• Inspect kernel crash dumps and stack traces for fault addresses inside the DLM subsystem
• Compare running kernel versions against distribution advisories that reference the listed fix commits
• Use eBPF or audit tracing on dlm_dump_rsb_name() entry to flag length values exceeding DLM_RESNAME_MAXLEN

Monitoring Recommendations

• Capture and review DLM traffic on cluster networks to identify oversized resource name fields
• Centralize kernel logs from all cluster members and alert on DLM-related warnings or backtraces
• Track patch state across the cluster, ensuring all nodes run a kernel that includes the validation fix

How to Mitigate CVE-2026-43125

Immediate Actions Required

• Apply the latest stable kernel update from your Linux distribution that incorporates the DLM length validation fix
• Restrict DLM communication to trusted cluster interconnects using firewall rules or dedicated VLANs
• Audit which hosts have network reachability to DLM ports and remove unnecessary access

Patch Information

The fix is delivered through the upstream Linux kernel commits 080e5563f878, 082083c9fbd9, 5f053a2e7209, and 67288113c5e6. The patch adds a length validation check so that values larger than DLM_RESNAME_MAXLEN are rejected before the buffer write. Consult your distribution vendor for backported kernel packages.

Workarounds

• Isolate cluster traffic on a private network segment with no external reachability to DLM ports
• Disable DLM-dependent services such as GFS2 or OCFS2 on systems where clustered locking is not required
• Enforce host-based firewall rules limiting DLM peers to known cluster member IP addresses

# Example: restrict DLM port 21064 to known cluster peers
iptables -A INPUT -p tcp --dport 21064 -s 10.0.0.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 21064 -j DROP

# Verify running kernel includes the DLM fix
uname -r
rpm -q --changelog kernel | grep -i "dlm_search_rsb_tree"