CVE-2026-89494

A flaw was found in ocfs2, a component of the Linux kernel. A remote attacker, by sending a specially crafted Distributed Lock Manager (DLM) migration message, could exploit a lack of validation in the dlm_mig_lockres_handler. This flaw allows for an out-of-bounds write to the heap, potentially leading to arbitrary code execution. Additionally, an out-of-bounds read could cause a system panic, resulting in a denial of service.

A flaw was found in the ocfs2 Distributed Lock Manager (DLM) of the Linux kernel, rated by Red Hat as Moderate. When a node receives a specially crafted DLM_MIG_LOCKRES migration message, the unvalidated num_locks and lockname_len fields allow an out-of-bounds read past the end of the allocated message buffer, which ends in a kernel panic and denial of service, and a heap out-of-bounds write when the lock name is copied into a fixed 32-byte object, potentially allowing arbitrary code execution. Exploitation requires the attacker to be a node participating in the OCFS2 DLM domain, so an attacker must already control or act as a trusted cluster node; for this reason Red Hat assesses the impact as Moderate (CVSS 5.5), significantly lower than the upstream CVSS 9.8 rating, which assumes an unauthenticated remote attacker. All Red Hat Enterprise Linux kernel and kernel-rt streams and the Red Hat OpenShift Container Platform (RHCOS) versions in scope are not affected because the vulnerable ocfs2 DLM code is not present in the shipped kernel packages.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.