CVE-2026-89494
A flaw in the Linux kernel’s OCFS2 distributed lock manager allows a node to send a malformed migration message that the kernel trusts without proper checks. The unchecked fields can cause out‑of‑bounds memory accesses, leading to a kernel panic. The issue is critical because it can be triggered by any node in the same domain.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Linux kernel, OCFS2 distributed lock manager (DLM) – any system using OCFS2 in a multi‑node environment.
Real-world impact
An attacker who can send a crafted DLM_MIG_LOCKRES message to a target node can force the kernel to read or write memory beyond the intended bounds, causing a crash and a denial of service. The crash can also expose kernel memory contents during the out‑of‑bounds read.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable over the network without authentication, with no user interaction required, and it can lead to complete compromise of confidentiality, integrity, and availability by crashing the kernel.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources