The Linux kernel's ocfs2 filesystem had a vulnerability in the dlm_mig_lockres_handler function where a node receiving a DLM_MIG_LOCKRES message did not validate the num_locks and lockname_len fields of the peer-supplied dlm_migratable_lockres structure. These fields were only bounded on the sending side, and the message was not verified to contain the claimed number of migratable lock entries. This led to dlm_process_recovery_data() reading out-of-bounds memory beyond the allocated message buffer, causing a BUG_ON kernel panic, and dlm_init_lockres() performing a heap out-of-bounds write by copying more bytes than the fixed 32-byte slab object could hold. The vulnerability is reachable by any node in the domain. The patch adds validation immediately after dlm_grab() to reject messages where lockname_len exceeds DLM_LOCKID_NAME_MAX, num_locks exceeds DLM_MAX_MIGRATABLE_LOCKS, or the payload is too small to hold the claimed locks. Legitimate recovery and migration messages are unaffected.

Exploitation of this vulnerability can cause out-of-bounds memory reads and writes in the kernel, leading to kernel panics (BUG_ON) or heap corruption. This can disrupt system stability and potentially be leveraged for denial of service or other impacts by any node in the domain sending crafted DLM_MIG_LOCKRES messages.

A fix is available that validates the num_locks and lockname_len fields in DLM_MIG_LOCKRES messages before they are processed. Systems should apply the official kernel patch that adds these validation checks. Until patched, nodes should be cautious about accepting DLM_MIG_LOCKRES messages from untrusted nodes in the domain. No other mitigation is indicated.