CVE-2026-89495 Overview
CVE-2026-89495 is a heap out-of-bounds write vulnerability in the Linux kernel's ocfs2 distributed lock manager (o2dlm). The dlm_migrate_request_handler() function trusts the peer-supplied migrate->namelen field without bounding it. The handler passes the unchecked length to dlm_init_mle(), which performs a memcpy() into the fixed 32-byte mname[] array of an o2dlm_mle slab object. A malformed message from a cluster peer overflows the slab object by up to approximately 215 bytes of attacker-controlled data. Any node that has joined the DLM domain, including a compromised member, can trigger the flaw.
Critical Impact
A single malformed DLM message from any cluster member can corrupt kernel heap memory on a peer node, enabling remote code execution or kernel panic across the ocfs2 cluster.
Affected Products
- Linux kernel with ocfs2 filesystem and o2dlm distributed lock manager enabled
- Long-term stable kernel branches referenced by the fix commits
- Systems participating in an ocfs2 cluster using o2net for peer communication
Discovery Timeline
- 2026-06-20 - Vulnerability reported privately to security@kernel.org and the ocfs2 maintainers
- 2026-09-11 - CVE-2026-89495 published to NVD
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2026-89495
Vulnerability Analysis
The o2dlm receive handlers accept u8 length and count fields directly from the wire without validating them against destination buffer sizes. dlm_migrate_request_handler() forwards migrate->namelen unchecked to dlm_init_mle(), which copies the specified number of bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[] field of the o2dlm_mle slab allocation.
Because namelen is an unsigned 8-bit value and the destination is 32 bytes, an attacker can overflow the slab object by up to 215 bytes. The write is attacker-controlled in both length and content. The same patch series also addresses two related defects in dlm_mig_lockres_handler(): an unchecked mres->lockname_len producing a slab overflow of up to 223 bytes, and an unchecked mres->num_locks that causes dlm_process_recovery_data() to walk mres->ml[] past the allocated buffer and trip a BUG_ON.
The reporter confirmed each sink under KASAN with an out-of-tree module and reproduced identical faults under userspace AddressSanitizer on 32-bit and 64-bit builds.
Root Cause
The migration and recovery receive handlers were added to the DLM without the length-bounding checks present in dlm_master_request_handler() and other o2dlm handlers. The kernel treats peer-supplied u8 fields as trusted inputs and passes them directly into fixed-size slab destinations via memcpy(). This is a classic out-of-bounds write [CWE-787] rooted in missing input validation on network-sourced data.
Attack Vector
Exploitation requires the attacker to be an authenticated member of the ocfs2 DLM domain. The o2net transport authenticates peers only by the DLM domain key, so any joined node, including a compromised or malicious member, can send a crafted DLM_MIGRATE_REQUEST message. There is no local trigger and no unauthenticated remote path from outside the cluster. Once inside the domain, the attacker sends a malformed migration message with an oversized namelen field to corrupt the target node's kernel heap.
No public proof-of-concept exploit code is available. Refer to the upstream patch commits for the exact fix and reproduction details.
Detection Methods for CVE-2026-89495
Indicators of Compromise
- Unexpected kernel panics or BUG_ON traps originating in dlm_process_recovery_data() or dlm_init_mle() on ocfs2 cluster nodes
- KASAN slab-out-of-bounds write reports referencing o2dlm_mle or o2dlm_lockname caches
- Unexplained ocfs2 or o2dlm log entries citing malformed migration or recovery messages from a peer
Detection Strategies
- Enable KASAN on test and staging cluster nodes to surface out-of-bounds writes in DLM slab caches during fuzzing or peer traffic replay
- Monitor kernel ring buffer output (dmesg) for oops traces containing dlm_migrate_request_handler, dlm_mig_lockres_handler, or dlm_init_mle symbols
- Correlate node reboots and panics across cluster members to identify anomalous DLM traffic patterns from a single peer
Monitoring Recommendations
- Ingest kernel logs from all ocfs2 cluster nodes into a centralized log platform and alert on DLM handler crashes
- Track o2net peer join and leave events to build a baseline of expected DLM domain membership
- Alert on new or unexpected nodes joining the DLM domain, since cluster membership is the sole prerequisite for exploitation
How to Mitigate CVE-2026-89495
Immediate Actions Required
- Apply the upstream kernel patches from the fix commits to all nodes participating in an ocfs2 cluster
- Audit ocfs2 DLM domain membership and remove any node that is not required for cluster operation
- Restrict o2net traffic to a dedicated, isolated cluster network segment inaccessible to general workloads
Patch Information
The fix is a two-patch series that bounds namelen in dlm_migrate_request_handler() and validates lockname_len, num_locks, and payload size in dlm_mig_lockres_handler(). Conforming migration and recovery traffic is unaffected. See the upstream fixes: Kernel Commit 006c96e, Kernel Commit 2487bea, Kernel Commit 2498990, Kernel Commit aabc5d8, Kernel Commit de10cd3b, Kernel Commit e1288865, Kernel Commit ea5b5609, and Kernel Commit f8658ee3.
Workarounds
- Unload the ocfs2_dlm and ocfs2 kernel modules on hosts that do not require ocfs2 clustering
- Isolate the o2net heartbeat and DLM network on a private VLAN accessible only to trusted cluster nodes
- Enforce network-layer access control lists that block o2net ports from any host outside the approved cluster membership list
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
