The Linux kernel ocfs2 distributed lock manager (DLM) had a vulnerability (CVE-2026-89495) where peer-supplied length fields in migration and recovery messages were not properly bounded. Specifically, dlm_migrate_request_handler passed an unchecked name length to dlm_init_mle(), causing a heap out-of-bounds write of up to ~215 bytes. Similarly, dlm_mig_lockres_handler passed an unchecked lockname length to dlm_init_lockres(), causing another heap out-of-bounds write of up to ~223 bytes. Additionally, the handler trusted the number of locks without verifying message size, leading to an out-of-bounds read and kernel panic. These flaws allow any node in the DLM domain, including malicious or compromised members, to corrupt or crash other cluster nodes. The patches add bounds checking to reject oversized names and validate message sizes. Conforming cluster traffic is unaffected.

A malicious or compromised node within the ocfs2 DLM cluster domain can send specially crafted migration or recovery messages that cause heap out-of-bounds writes or out-of-bounds reads in other cluster nodes. This can lead to memory corruption or kernel panic, potentially disrupting cluster operations. There is no local trigger; the attacker must already be a member of the cluster domain. Conforming cluster traffic is not affected.

Patches have been released that add proper bounds checking to the affected DLM message handlers, preventing out-of-bounds memory operations. Cluster operators should apply these kernel patches to ensure the vulnerability is mitigated. Since the vulnerability requires cluster membership, restricting cluster membership to trusted nodes also reduces risk. There is no indication that additional mitigations are necessary beyond applying the official fixes.