From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5FC2D583AB3 for ; Fri, 11 Sep 2026 19:52:49 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156380; cv=none; b=Ge38TMS/fTWc/yYL+2BSfCMdzUAtIJ2lZDqBkdlBNwUZBVFrnbNQX/SvGlSnrhB+2u8xJ+n+lEN0U5JO9B04gLs2KVHqz6b0KMZ3ueX+cj4OyUm9uFWUO8YL3xnqRVY0BVjm3s6oL6L+KzeXtU6FNqLkH4I2xt4BrvUt09rqWH0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789156380; c=relaxed/simple; bh=CsRbFFXx44OSNXQNqvtBrRF4NpN9R+8jP+aGEpKkiD4=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=np5USXUyaorIDY8XU/7WcMXf66HnCO9HrnZf1UtDyrybBaaMA9o4u0egVpOHKMroFIQxs+w8OGCcJpeSk7KOFvYea7Ixuhj9rmpCfKvvctJ5xCpO61V5uUjzZpUa05xTfvwIczWoVfSp1n43Kv391q01g/7noECS91j8N4roZ6g= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=ZaAKSeJi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="ZaAKSeJi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id AFAA11F00893; Fri, 11 Sep 2026 19:52:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789156369; bh=2yujhBc59s2VHu7sEYIBSy+xUVJs1buU/A2sStRk+BU=; h=From:To:Cc:Subject:Date:Reply-To; b=ZaAKSeJiVvBYIMnNOnZ/isyC33o1189CdtFFMxx7svSbGIsz4SM/JR2IArr9VXXKd UK+PLvWy3qLLYBQWEFfj5up7+YP83LV3oXWb1vT7+z957viZEZEhcpyendLOBFXku/ nL4EgQpvtSzWR1RO9A4M6tec4nbBGjeXWzlLf3iw= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-89495: ocfs2: bound namelen in dlm_migrate_request_handler Date: Fri, 11 Sep 2026 21:43:04 +0200 Message-ID: <2026091108-CVE-2026-89495-980e@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=5083; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=rIHSqYccbMr7AJlXnqNYk7Pi+LY4y/zzXBxGnxFlhcc=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlLIkPiPs1g99hVvaN9J9uveQeX3nva7MEoPOWl/DMHg dnef+qndMSyMAgyMciKKbJ82cZzdH/FIUUvQ9vTMHNYmUCGMHBxCsBEvh1lmCu21fRswIf22TOb VWfyzdrAsbl9gy3D/PhJTf5PxOVT9vTZHefzuFT3StGRDQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in a DLM domain can corrupt or panic any other node with a malformed message. Three defects: - dlm_migrate_request_handler() passes migrate->namelen unchecked to dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an o2dlm_mle slab object: a heap out-of-bounds write of up to ~215 attacker-controlled bytes. - dlm_mig_lockres_handler() passes mres->lockname_len unchecked to dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname slab object: a heap out-of-bounds write of up to ~223 bytes. - the same handler trusts mres->num_locks without checking that the message is large enough to hold that many entries, so dlm_process_recovery_data() walks mres->ml[] past the kmalloc(data_len) copy and trips a BUG_ON (an out-of-bounds read ending in a panic). The other o2dlm receive handlers already reject an oversized name; the migration and recovery handlers have omitted it since the DLM was added (see the Fixes tags). Patch 1 bounds namelen; patch 2 validates lockname_len, num_locks, and the payload size. Conforming recovery and migration traffic is unaffected. o2net authenticates peers only by the DLM domain key, so any node that has joined the domain -- including a compromised or malicious member -- can send these messages. There is no local trigger; the attacker must already be a member of the cluster. Each sink was confirmed under KASAN with an out-of-tree module mirroring it exactly -- a kmem_cache/kmalloc of the real destination size, then the same unclamped memcpy/loop: slab-out-of-bounds Write for the two writes, Read for the recovery walk, and a panic. A userspace AddressSanitizer build faults identically under -m32 and -m64. Scrubbed logs are available on request. I reported this privately to security@kernel.org and the ocfs2 maintainers on 2026-06-20; with no response after the standard embargo period I am posting the fix publicly. I have no embargo requirement. This patch (of 2): A node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied name length (migrate->namelen) without bounding it. dlm_init_mle() then copies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[] array of an o2dlm_mle slab object, so a malformed message from a cluster peer overflows the slab object by up to ~215 bytes: a heap out-of-bounds write of attacker-controlled data, reachable by any node in the domain. Reject an oversized name, the way dlm_master_request_handler() and the other o2dlm receive handlers already do; the migration handler omits the check entirely. Conforming messages are unaffected. The Linux kernel CVE team has assigned CVE-2026-89495 to this issue. Affected and fixed versions =========================== Issue introduced in 2.6.16 with commit 6714d8e86bf443f6f7af50f9d432025649f091f5 and fixed in 6.12.109 with commit f8658ee3327f73bd81c0bcd07cdeb5a8527fac98 Issue introduced in 2.6.16 with commit 6714d8e86bf443f6f7af50f9d432025649f091f5 and fixed in 6.18.50 with commit de10cd3b062a5235af754925fcf49beb5a1109d4 Issue introduced in 2.6.16 with commit 6714d8e86bf443f6f7af50f9d432025649f091f5 and fixed in 7.2.4 with commit 2487bea2098322669f0563baff53e797486b823f Issue introduced in 2.6.16 with commit 6714d8e86bf443f6f7af50f9d432025649f091f5 and fixed in 7.3-rc1 with commit ea5b5609305a8437bc955a0834a530c12246d78f Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-89495 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: fs/ocfs2/dlm/dlmmaster.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f8658ee3327f73bd81c0bcd07cdeb5a8527fac98 https://git.kernel.org/stable/c/de10cd3b062a5235af754925fcf49beb5a1109d4 https://git.kernel.org/stable/c/2487bea2098322669f0563baff53e797486b823f https://git.kernel.org/stable/c/ea5b5609305a8437bc955a0834a530c12246d78f