CVE-2026-89491 Overview
CVE-2026-89491 is a Linux kernel vulnerability in the OCFS2 cluster heartbeat subsystem. The flaw resides in o2hb_region_pin(), which is invoked while holding the o2hb_live_lock spinlock but internally calls configfs_depend_item(), a function that sleeps. Under kernels built with CONFIG_DEBUG_ATOMIC_SLEEP, this triggers a BUG. The patch series also addresses a related lock order inversion between parent inode and configfs root inode locks, plus a reference counter leak in o2hb_region_inc_user() when pinning fails partway through region iteration.
Critical Impact
Local, low-privileged operations that mount OCFS2 volumes can trigger kernel warnings, deadlocks between subsystem unregistration paths, and leave heartbeat regions unprotected on subsequent mounts.
Affected Products
- Linux kernel builds shipping the OCFS2 (Oracle Cluster File System version 2) filesystem
- Kernel versions containing commit 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions") prior to the fix commits listed in the references
- Distributions enabling CONFIG_OCFS2_FS with cluster heartbeat support
Discovery Timeline
- 2026-09-11 - CVE-2026-89491 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89491
Vulnerability Analysis
The defect is a classic sleep-while-atomic issue in the OCFS2 cluster heartbeat code. o2hb_region_pin() is called from two paths, o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item(), both of which hold o2hb_live_lock, a spinlock. Inside o2hb_region_pin(), the kernel invokes o2nm_depend_item(), which calls configfs_depend_item(). That function pins the configfs filesystem and acquires the configfs root inode read-write semaphore via down_write, both of which can sleep.
Beyond the atomic-context violation, calling the sleeping variant from a configfs drop_item callback creates a lock order inversion. The inc/drop path takes parent inode_lock then configfs root inode_lock, while subsystem unregistration takes them in reverse order, producing a deadlock opportunity. A third defect leaks the o2hb_dependent_users counter when partial pinning fails, leaving heartbeat regions unprotected on subsequent mounts.
Root Cause
The root cause is improper synchronization primitive selection [CWE-667]. The original implementation from commit 58a3158a5d17 did not account for configfs_depend_item() being a sleeping call and placed it inside a spinlock-protected critical section.
Attack Vector
Exploitation requires local access with the ability to mount OCFS2 volumes or manipulate cluster heartbeat regions through configfs. Triggering the atomic-context BUG produces a kernel warning and, under adverse timing, a deadlock in the DLM registration path invoked during ocfs2_mount_volume -> ocfs2_dlm_init. The counter-leak variant can leave heartbeat regions unprotected after a failed mount, degrading cluster integrity guarantees.
The vulnerability is described in prose only; no proof-of-concept code is published. Refer to the upstream fix commits linked below for the exact call-site restructuring.
Detection Methods for CVE-2026-89491
Indicators of Compromise
- Kernel log entries containing BUG: sleeping function called from invalid context at kernel/locking/rwsem.c with a call chain including configfs_depend_item, o2hb_region_pin, and o2hb_region_inc_user.
- Soft lockup or hung task warnings referencing mount.ocfs2, ocfs2_dlm_init, or dlm_register_domain_handlers.
- Cluster nodes reporting missing or unpinned heartbeat regions after a failed OCFS2 mount attempt.
Detection Strategies
- Enable CONFIG_DEBUG_ATOMIC_SLEEP in test kernels to surface the atomic-context violation deterministically.
- Monitor dmesg and centralized syslog for the specific BUG signature involving o2hb_region_pin in the stack trace.
- Correlate OCFS2 mount failures with subsequent cluster heartbeat state anomalies to identify the counter-leak condition.
Monitoring Recommendations
- Forward kernel ring buffer messages to a centralized logging platform and alert on BUG: or WARNING: entries referencing o2hb_ symbols.
- Track OCFS2 mount success and failure rates across cluster nodes to detect regressions.
- Audit running kernel versions against the fix commit list to confirm patched builds are deployed.
How to Mitigate CVE-2026-89491
Immediate Actions Required
- Update to a Linux kernel that includes the OCFS2 fix commits listed in the references.
- Rebuild custom kernels with the three-patch series applied to fs/ocfs2/cluster/heartbeat.c and related configfs helpers.
- Restrict OCFS2 mount privileges to trusted administrators on multi-tenant systems until patched kernels are deployed.
Patch Information
The fix is delivered through a three-patch series. Patch 1 reworks o2hb_region_pin() to pin one region at a time, dropping o2hb_live_lock across each sleeping configfs_depend_item() call while holding a config_item reference. Patch 2 introduces a from_callback parameter to select configfs_depend_item_unlocked() when invoked from configfs context, avoiding inode lock nesting. Patch 3 corrects the error path in o2hb_region_inc_user() to unpin and decrement the counter on failure. See the upstream commits: 0cbc2f20a6ea, 3b790774280a, 470212a5eefa, 49002acc520c, 4d64f8da82fb, af09df89db9a, c9be4de77f97, and ce035f208d68.
Workarounds
- Avoid loading the OCFS2 filesystem module on hosts that do not require cluster filesystem support.
- Blacklist ocfs2 and related cluster modules via /etc/modprobe.d/ on affected kernels until patches are applied.
- Limit local user access to mount operations through PAM, sudoers, or namespace restrictions to reduce trigger surface.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.