CVE-2026-89495
A flaw in the Linux kernel’s OCFS2 Distributed Lock Manager (DLM) allowed cluster members to send malformed messages that overflowed internal buffers, potentially corrupting memory or crashing other nodes. The issue was fixed by patching the kernel to bound peer‑controlled lengths in the o2dlm receive handlers.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
Linux kernel users running OCFS2 with a DLM domain; any node that is a member of the cluster can be affected.
Real-world impact
An attacker who has joined the cluster can craft a DLM message that overflows a heap buffer, causing data corruption or a crash on other cluster nodes, which can lead to loss of service or data integrity.
Why this severity
The CVSS score of 9.8 reflects that the vulnerability is exploitable remotely with no authentication, and it can compromise confidentiality, integrity, and availability of all nodes in the cluster.
What to do about it
- 01Update the Linux kernel to a version that includes the ocfs2/dlm patch series that bounds peer‑controlled lengths.
- 02Reboot the system to load the updated kernel.
NVD description
Timeline
- Sep 11, 2026 · 2d agoPublishedDisclosed and added to the National Vulnerability Database.
- Sep 13, 2026 · 8h agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.