CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate lengths in dlm_mig_lockres_handler

A node receiving a DLM_MIG_LOCKRES message trusts several fields of the

peer-supplied dlm_migratable_lockres without validation. num_locks and

lockname_len are bounded only on the sending side, and the message is

never checked to actually carry num_locks migratable_lock entries. As a

result dlm_process_recovery_data() walks mres->ml[0..num_locks) past the

kmalloc(data_len) copy of the message (an out-of-bounds read that ends in

a BUG_ON panic), and dlm_init_lockres() copies lockname_len bytes into the

fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write).

Both are reachable by any node in the domain.

Validate these fields right after dlm_grab(), before anything uses them --

including the not-joined error path, which already prints mres->lockname

with the unbounded lockname_len as a %.*s precision. Reject the message

unless lockname_len <= DLM_LOCKID_NAME_MAX, num_locks <=

DLM_MAX_MIGRATABLE_LOCKS (the bound the sender already asserts), and the

payload is large enough to hold the claimed locks. Conforming recovery

and migration messages are unaffected.