CVE-2026-90301
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
In the Linux kernel, the ocfs2 (o2hb) subsystem has a use-after-free bug in the heartbeat region lifecycle. The region is published to the o2net handler table before its delayed works are initialized, and teardown does not fully drain in-flight o2net callbacks. This causes a race and use of freed memory (KASAN slab-use-after-free in __run_timers).
Risk Assessment
The vulnerability can lead to kernel memory corruption, system crash (panic), or potentially privilege escalation in environments using the OCFS2 clustered filesystem. It requires local access and an OCFS2 heartbeat configuration, but the impact on node stability and security can be severe.
Recommendation
Update the Linux kernel to a version containing the fix for CVE-2026-90301 (ocfs2: o2hb: quiesce negotiate handlers and timeout work). If OCFS2 is not used, consider disabling or not loading the ocfs2 module to reduce the attack surface.
Other vulnerabilities in Linux kernel (ocfs2)
See all- CVE-2026-89494Critical
In the Linux kernel, the ocfs2 dlm_mig_lockres_handler trusted the num_locks and lockname_len fields from a DLM_MIG_LOCKRES message without validation. This led to an out-of-bounds read (BUG_ON panic) and a heap out-of-bounds write when copying the lock name into a fixed 32-byte object. Any node in the domain could trigger this.
- CVE-2026-89492Critical
A vulnerability was found in the Linux kernel's ocfs2 module due to missing validation of directory-index entry counts when reading metadata. The functions ocfs2_validate_dx_leaf() and ocfs2_validate_dx_root() do not bound the de_num_used and de_count fields against the block capacity, allowing a crafted on-disk image to set them to 0xffff and cause an out-of-bounds read past the 4KB metadata block. The flaw is reachable from any path lookup, stat() or open() on an indexed directory once the image is mounted.
- CVE-2026-89496Low risk· EPSS 6%
In the Linux kernel, the ocfs2 filesystem has a memory leak during copy-on-write operations triggered by copy_file_range() within the same filesystem. The issue was found by fuzzing and occurs because deallocations are not always run on copy-on-write completion, leading to unreferenced memory allocations.
- CVE-2026-89493High
The Linux kernel ocfs2 module lacked validation of the rl_used and rl_count fields in the refcount block. A crafted or corrupted ocfs2 image with rl_used set to 0xffff causes an out-of-bounds read past the metadata block and a subsequent out-of-bounds memmove during a reflink (FICLONE) operation. Exploitation requires local access (CAP_SYS_ADMIN mounting a crafted image or raw write to the backing block device).
- CVE-2026-89490Low risk· EPSS 6%
In the Linux kernel, the ocfs2 function ocfs2_dir_foreach_blk_el() on 32-bit kernels incorrectly computed the directory position mask, clearing the high 32 bits of the position. When readdir() crossed the 4 GiB boundary, the position was reset, causing infinite re-enumeration of already-returned directory entries.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down. The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue(). Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg. The buggy scenario involves two paths, with each column showing the order within that path: region lifecycle: late negotiate callback: 1. make_item() registers the 1. o2net_process_message() gets a region handlers before heartbeat handler for reg. dev_store() has built a 2. The callback runs after the lookup runnable heartbeat context. lock is dropped and dereferences reg. 2. A failed start or rmdir 3. An approve or timeout path tries to stops the heartbeat thread, queue reg's delayed work, or release quiesces existing work, and races the callback body after handler drops the final configfs ref. unregister. 3. region_release() must drain 4. The callback or delayed work can handler-visible o2net rx work outlive reg unless lifecycle code before freeing reg. keeps the region non-armable and drains the active-or-destroying o2net workqueue. Validation reproduced this kernel report: KASAN slab-use-after-free in __run_timers+0x22c/0x5b0 Write of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 __run_timers+0x22c/0x5b0 kasan_report+0xe0/0x110 _raw_spin_unlock_irqrestore+0x27/0x60 try_to_wake_up+0x191/0xf70 timer_expire_remote+0xae/0xf0 run_timer_softirq+0x19b/0x1a0 handle_softirqs+0x156/0x660 __irq_exit_rcu+0xc4/0x160 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x6c/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 Allocated by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 o2hb_heartbeat_group_make_item+0x3c/0x600
Vulnerability data from NVD (NIST) · CISA KEV · EPSS