Buffer Overflow in Linux Kernel OCFS2 DLM

Publication date: 2026-06-26

Last updated on: 2026-07-06

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-26

Last Modified

2026-07-06

Generated

2026-07-17

AI Q&A

2026-06-26

EPSS Evaluated

2026-07-15

NVD

CVE-2026-53309

EUVD

EUVD-2026-39844

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.209 (exc)
linux	linux_kernel	From 2.6.37 (inc) to 5.10.258 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-193	A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

Executive Summary

This vulnerability is an off-by-one error in the Linux kernel's ocfs2/dlm component, specifically in the dlm_match_regions() function. The issue arises because the local-versus-remote region comparison loop uses a less-than-or-equal-to ('<=') condition instead of a less-than ('<') condition. This causes the loop to read one entry beyond the valid range of qr_regions, potentially leading to incorrect behavior or memory access errors. The fix involves correcting the loop condition to use '<' for proper bounds checking.

Impact Analysis

The off-by-one error in the region comparison loop can cause the function to read memory beyond the intended range. This may lead to unexpected behavior such as data corruption, crashes, or other stability issues within the Linux kernel's ocfs2/dlm subsystem. Since this is a local kernel vulnerability, it could potentially be exploited by a local user or process to cause denial of service or other unintended effects.

Hi! I’m here to help you understand CVE-2026-53309. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70