GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-89495 (GCVE-0-2026-89495)

Vulnerability from cvelistv5 – Published: 2026-09-11 19:43 – Updated: 2026-09-14 12:00
VLAI
Title
ocfs2: bound namelen in dlm_migrate_request_handler
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: bound namelen in dlm_migrate_request_handler Patch series "ocfs2/dlm: bound peer-controlled lengths in the o2dlm". The o2dlm receive handlers trust u8 length and count fields from the wire without bounding them, so a node in a DLM domain can corrupt or panic any other node with a malformed message. Three defects: - dlm_migrate_request_handler() passes migrate->namelen unchecked to dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an o2dlm_mle slab object: a heap out-of-bounds write of up to ~215 attacker-controlled bytes. - dlm_mig_lockres_handler() passes mres->lockname_len unchecked to dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname slab object: a heap out-of-bounds write of up to ~223 bytes. - the same handler trusts mres->num_locks without checking that the message is large enough to hold that many entries, so dlm_process_recovery_data() walks mres->ml[] past the kmalloc(data_len) copy and trips a BUG_ON (an out-of-bounds read ending in a panic). The other o2dlm receive handlers already reject an oversized name; the migration and recovery handlers have omitted it since the DLM was added (see the Fixes tags). Patch 1 bounds namelen; patch 2 validates lockname_len, num_locks, and the payload size. Conforming recovery and migration traffic is unaffected. o2net authenticates peers only by the DLM domain key, so any node that has joined the domain -- including a compromised or malicious member -- can send these messages. There is no local trigger; the attacker must already be a member of the cluster. Each sink was confirmed under KASAN with an out-of-tree module mirroring it exactly -- a kmem_cache/kmalloc of the real destination size, then the same unclamped memcpy/loop: slab-out-of-bounds Write for the two writes, Read for the recovery walk, and a panic. A userspace AddressSanitizer build faults identically under -m32 and -m64. Scrubbed logs are available on request. I reported this privately to security@kernel.org and the ocfs2 maintainers on 2026-06-20; with no response after the standard embargo period I am posting the fix publicly. I have no embargo requirement. This patch (of 2): A node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied name length (migrate->namelen) without bounding it. dlm_init_mle() then copies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[] array of an o2dlm_mle slab object, so a malformed message from a cluster peer overflows the slab object by up to ~215 bytes: a heap out-of-bounds write of attacker-controlled data, reachable by any node in the domain. Reject an oversized name, the way dlm_master_request_handler() and the other o2dlm receive handlers already do; the migration handler omits the check entirely. Conforming messages are unaffected.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < e1288865b8ceac0dcd1009ecba43de961f13d5bd (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < aabc5d8388e6f8826345f0073455dbcaaaa6491d (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < 006c96ea488eca2ef5155ec76038e0a4dbf65f0a (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < 24989909d3413b44b104102caa6661b1e424ba0f (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < f8658ee3327f73bd81c0bcd07cdeb5a8527fac98 (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < de10cd3b062a5235af754925fcf49beb5a1109d4 (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < 2487bea2098322669f0563baff53e797486b823f (git)
Affected: 6714d8e86bf443f6f7af50f9d432025649f091f5 , < ea5b5609305a8437bc955a0834a530c12246d78f (git)
guessed Create a notification for this product.
Linux Linux Affected: 2.6.16
Unaffected: 0 , < 2.6.16 (semver)
Unaffected: 5.10.270 , ≤ 5.10.* (semver)
Unaffected: 5.15.221 , ≤ 5.15.* (semver)
Unaffected: 6.1.188 , ≤ 6.1.* (semver)
Unaffected: 6.6.157 , ≤ 6.6.* (semver)
Unaffected: 6.12.109 , ≤ 6.12.* (semver)
Unaffected: 6.18.50 , ≤ 6.18.* (semver)
Unaffected: 7.2.4 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dlm/dlmmaster.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e1288865b8ceac0dcd1009ecba43de961f13d5bd",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "aabc5d8388e6f8826345f0073455dbcaaaa6491d",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "006c96ea488eca2ef5155ec76038e0a4dbf65f0a",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "24989909d3413b44b104102caa6661b1e424ba0f",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "f8658ee3327f73bd81c0bcd07cdeb5a8527fac98",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "de10cd3b062a5235af754925fcf49beb5a1109d4",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "2487bea2098322669f0563baff53e797486b823f",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            },
            {
              "lessThan": "ea5b5609305a8437bc955a0834a530c12246d78f",
              "status": "affected",
              "version": "6714d8e86bf443f6f7af50f9d432025649f091f5",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/dlm/dlmmaster.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.16"
            },
            {
              "lessThan": "2.6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.270",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.221",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.188",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.157",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.109",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.50",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.4",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "2.6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: bound namelen in dlm_migrate_request_handler\n\nPatch series \"ocfs2/dlm: bound peer-controlled lengths in the o2dlm\".\n\nThe o2dlm receive handlers trust u8 length and count fields from the wire\nwithout bounding them, so a node in a DLM domain can corrupt or panic any\nother node with a malformed message.  Three defects:\n\n  - dlm_migrate_request_handler() passes migrate-\u003enamelen unchecked to\n    dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an\n    o2dlm_mle slab object: a heap out-of-bounds write of up to ~215\n    attacker-controlled bytes.\n\n  - dlm_mig_lockres_handler() passes mres-\u003elockname_len unchecked to\n    dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname\n    slab object: a heap out-of-bounds write of up to ~223 bytes.\n\n  - the same handler trusts mres-\u003enum_locks without checking that the\n    message is large enough to hold that many entries, so\n    dlm_process_recovery_data() walks mres-\u003eml[] past the kmalloc(data_len)\n    copy and trips a BUG_ON (an out-of-bounds read ending in a panic).\n\nThe other o2dlm receive handlers already reject an oversized name; the\nmigration and recovery handlers have omitted it since the DLM was added\n(see the Fixes tags).  Patch 1 bounds namelen; patch 2 validates\nlockname_len, num_locks, and the payload size.  Conforming recovery and\nmigration traffic is unaffected.\n\no2net authenticates peers only by the DLM domain key, so any node that has\njoined the domain -- including a compromised or malicious member -- can\nsend these messages.  There is no local trigger; the attacker must already\nbe a member of the cluster.\n\nEach sink was confirmed under KASAN with an out-of-tree module mirroring\nit exactly -- a kmem_cache/kmalloc of the real destination size, then the\nsame unclamped memcpy/loop: slab-out-of-bounds Write for the two writes,\nRead for the recovery walk, and a panic.  A userspace AddressSanitizer\nbuild faults identically under -m32 and -m64.  Scrubbed logs are available\non request.\n\nI reported this privately to security@kernel.org and the ocfs2 maintainers\non 2026-06-20; with no response after the standard embargo period I am\nposting the fix publicly.  I have no embargo requirement.\n\n\nThis patch (of 2):\n\nA node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied\nname length (migrate-\u003enamelen) without bounding it.  dlm_init_mle() then\ncopies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[]\narray of an o2dlm_mle slab object, so a malformed message from a cluster\npeer overflows the slab object by up to ~215 bytes: a heap out-of-bounds\nwrite of attacker-controlled data, reachable by any node in the domain.\n\nReject an oversized name, the way dlm_master_request_handler() and the\nother o2dlm receive handlers already do; the migration handler omits the\ncheck entirely.  Conforming messages are unaffected."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - DLM_MIGRATE_REQUEST is received and dispatched by the ocfs2 o2net TCP cluster transport, so dlm_migrate_request_handler() is reached through network protocol messages from a peer node.\nAC:L - A cluster peer can send a crafted DLM_MIGRATE_REQUEST with attacker-chosen namelen; dlm_init_mle() then memcpy()s that length into the 32-byte mname[] with no race or other condition outside the attacker\u0027s control.\nPR:N - o2net gates peers by configured node IP, heartbeat, and the DLM domain key, with no user authentication or target-local privilege check before the handler runs, so exploitation needs no account on the victim.\nUI:N - Once the OCFS2/DLM domain is joined, exploitation is driven entirely by attacker-sent o2net messages and requires no victim user action such as mounting or opening a file.\nS:U - The heap overflow and resulting kernel impact remain within the same kernel and OCFS2 cluster-node security authority and do not cross a guest-to-host or IOMMU boundary.\nC:H - Unchecked namelen produces a heap out-of-bounds write of attacker-controlled bytes past the o2dlm_mle slab object and an out-of-bounds read of the source name buffer, which can disclose adjacent kernel memory.\nI:H - dlm_init_mle() memcpy()s up to 255 attacker-controlled bytes into the 32-byte mname[] of an o2dlm_mle slab object, overflowing the object by about 215 bytes and enabling overwrite of adjacent heap objects and kernel control-flow hijacking.\nA:H - The heap out-of-bounds write past the o2dlm_mle slab object can oops or panic the receiving node, fully denying availability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T12:00:29.988Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e1288865b8ceac0dcd1009ecba43de961f13d5bd"
        },
        {
          "url": "https://git.kernel.org/stable/c/aabc5d8388e6f8826345f0073455dbcaaaa6491d"
        },
        {
          "url": "https://git.kernel.org/stable/c/006c96ea488eca2ef5155ec76038e0a4dbf65f0a"
        },
        {
          "url": "https://git.kernel.org/stable/c/24989909d3413b44b104102caa6661b1e424ba0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/f8658ee3327f73bd81c0bcd07cdeb5a8527fac98"
        },
        {
          "url": "https://git.kernel.org/stable/c/de10cd3b062a5235af754925fcf49beb5a1109d4"
        },
        {
          "url": "https://git.kernel.org/stable/c/2487bea2098322669f0563baff53e797486b823f"
        },
        {
          "url": "https://git.kernel.org/stable/c/ea5b5609305a8437bc955a0834a530c12246d78f"
        }
      ],
      "title": "ocfs2: bound namelen in dlm_migrate_request_handler",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-89495",
    "datePublished": "2026-09-11T19:43:46.107Z",
    "dateReserved": "2026-09-11T19:38:34.714Z",
    "dateUpdated": "2026-09-14T12:00:29.988Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-89495",
      "date": "2026-09-16",
      "epss": "0.00704",
      "percentile": "0.51597"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-15T01:46:00.000Z",
      "cve": "CVE-2026-89495",
      "id": "msrc_CVE-2026-89495",
      "initial_release_date": "2026-09-13T01:02:51.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: bound namelen in dlm_migrate_request_handler",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-89495.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-89495\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-09-11T20:19:31.493\",\"lastModified\":\"2026-09-14T13:19:06.590\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nocfs2: bound namelen in dlm_migrate_request_handler\\n\\nPatch series \\\"ocfs2/dlm: bound peer-controlled lengths in the o2dlm\\\".\\n\\nThe o2dlm receive handlers trust u8 length and count fields from the wire\\nwithout bounding them, so a node in a DLM domain can corrupt or panic any\\nother node with a malformed message.  Three defects:\\n\\n  - dlm_migrate_request_handler() passes migrate-\u003enamelen unchecked to\\n    dlm_init_mle(), which memcpy()s it into the 32-byte mname[] of an\\n    o2dlm_mle slab object: a heap out-of-bounds write of up to ~215\\n    attacker-controlled bytes.\\n\\n  - dlm_mig_lockres_handler() passes mres-\u003elockname_len unchecked to\\n    dlm_init_lockres(), which memcpy()s it into the 32-byte o2dlm_lockname\\n    slab object: a heap out-of-bounds write of up to ~223 bytes.\\n\\n  - the same handler trusts mres-\u003enum_locks without checking that the\\n    message is large enough to hold that many entries, so\\n    dlm_process_recovery_data() walks mres-\u003eml[] past the kmalloc(data_len)\\n    copy and trips a BUG_ON (an out-of-bounds read ending in a panic).\\n\\nThe other o2dlm receive handlers already reject an oversized name; the\\nmigration and recovery handlers have omitted it since the DLM was added\\n(see the Fixes tags).  Patch 1 bounds namelen; patch 2 validates\\nlockname_len, num_locks, and the payload size.  Conforming recovery and\\nmigration traffic is unaffected.\\n\\no2net authenticates peers only by the DLM domain key, so any node that has\\njoined the domain -- including a compromised or malicious member -- can\\nsend these messages.  There is no local trigger; the attacker must already\\nbe a member of the cluster.\\n\\nEach sink was confirmed under KASAN with an out-of-tree module mirroring\\nit exactly -- a kmem_cache/kmalloc of the real destination size, then the\\nsame unclamped memcpy/loop: slab-out-of-bounds Write for the two writes,\\nRead for the recovery walk, and a panic.  A userspace AddressSanitizer\\nbuild faults identically under -m32 and -m64.  Scrubbed logs are available\\non request.\\n\\nI reported this privately to security@kernel.org and the ocfs2 maintainers\\non 2026-06-20; with no response after the standard embargo period I am\\nposting the fix publicly.  I have no embargo requirement.\\n\\n\\nThis patch (of 2):\\n\\nA node receiving a DLM_MIGRATE_REQUEST message trusts the peer-supplied\\nname length (migrate-\u003enamelen) without bounding it.  dlm_init_mle() then\\ncopies that many bytes into the fixed DLM_LOCKID_NAME_MAX-byte mname[]\\narray of an o2dlm_mle slab object, so a malformed message from a cluster\\npeer overflows the slab object by up to ~215 bytes: a heap out-of-bounds\\nwrite of attacker-controlled data, reachable by any node in the domain.\\n\\nReject an oversized name, the way dlm_master_request_handler() and the\\nother o2dlm receive handlers already do; the migration handler omits the\\ncheck entirely.  Conforming messages are unaffected.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/ocfs2/dlm/dlmmaster.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"e1288865b8ceac0dcd1009ecba43de961f13d5bd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"aabc5d8388e6f8826345f0073455dbcaaaa6491d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"006c96ea488eca2ef5155ec76038e0a4dbf65f0a\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"24989909d3413b44b104102caa6661b1e424ba0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"f8658ee3327f73bd81c0bcd07cdeb5a8527fac98\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"de10cd3b062a5235af754925fcf49beb5a1109d4\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"2487bea2098322669f0563baff53e797486b823f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"6714d8e86bf443f6f7af50f9d432025649f091f5\",\"lessThan\":\"ea5b5609305a8437bc955a0834a530c12246d78f\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/ocfs2/dlm/dlmmaster.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.16\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.16\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.270\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.221\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.188\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.157\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.109\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.50\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2.4\",\"lessThanOrEqual\":\"7.2.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.3-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/006c96ea488eca2ef5155ec76038e0a4dbf65f0a\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/2487bea2098322669f0563baff53e797486b823f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/24989909d3413b44b104102caa6661b1e424ba0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/aabc5d8388e6f8826345f0073455dbcaaaa6491d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/de10cd3b062a5235af754925fcf49beb5a1109d4\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e1288865b8ceac0dcd1009ecba43de961f13d5bd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/ea5b5609305a8437bc955a0834a530c12246d78f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f8658ee3327f73bd81c0bcd07cdeb5a8527fac98\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-13T06:49:33+00:00",
      "cve": "CVE-2026-89495",
      "id": "CVE-2026-89495",
      "initial_release_date": "2026-09-11T19:43:46.107000+00:00",
      "product_status:known_affected": "2",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ocfs2: Arbitrary code execution and Denial of Service via malformed Distributed Lock Manager messages",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89495.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-16T00:02:51Z",
      "cve": "CVE-2026-89495",
      "id": "CVE-2026-89495",
      "initial_release_date": "2026-09-16T00:02:51Z",
      "product_status:known_affected": "353",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-89495",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-89495.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.