Executive Summary

This vulnerability exists in the Linux kernel's ocfs2/dlm component, specifically in the dlm_match_regions() function. The issue arises because the qr_numregions field from a DLM_QUERY_REGION network message is used directly as a loop bound without proper validation against the maximum allowed regions (O2NM_MAX_REGIONS).

Because the o2net layer only validates message byte length and not the actual field values, an attacker can craft a message with qr_numregions set to a value greater than the maximum (up to 255), causing the function to read beyond the allocated qr_regions buffer (which can hold only up to 32 entries). This leads to out-of-bounds reads.

Additionally, there was an off-by-one error in the comparison loop that could cause reading one entry past the valid range even when qr_numregions was within bounds. The patch fixes both the lack of bounds checking and the off-by-one error.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads in the Linux kernel's ocfs2/dlm component. Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive kernel memory contents to an attacker.

An attacker who can send crafted DLM_QUERY_REGION network messages could exploit this flaw to read memory beyond intended boundaries, which might lead to information disclosure or denial of service conditions.

Useful 0 Not Useful 0

Mitigation Strategies

The vulnerability is fixed by applying a patch that adds a bounds check for the qr_numregions field in the dlm_match_regions() function of the Linux kernel.

To mitigate this vulnerability immediately, you should update your Linux kernel to a version that includes the patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()" which was published on 2026-06-24.

Useful 0 Not Useful 0