CVE-2026-43125

A flaw was found in the Linux kernel's Distributed Lock Manager (dlm) module. An attacker could send specially crafted network messages with an oversized length parameter to the dlm_dump_rsb_name() function. This lack of validation can lead to an out-of-bounds write in the dlm_search_rsb_tree() function, potentially causing a buffer overflow. This vulnerability could allow for denial of service or, in some cases, arbitrary code execution.

Red Hat has classified this vulnerability as having Important impact because an out-of-bounds write in kernel memory can lead to system crashes or potential execution of arbitrary code with kernel privileges. In standard deployments, the Distributed Lock Manager module is not loaded by default and is only exposed when clustering or shared-disk storage services such as GFS2 are active. Consequently, systems operating outside of high-availability cluster configurations do not expose the affected interface.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.