CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate lengths in dlm mig lockres handler

A node receiving a DLM MIG LOCKRES message trusts several fields of the peer-supplied dlm migratable lockres without validation. num locks and lockname len are bounded only on the sending side, and the message is never checked to actually carry num locks migratable lock entries. As a result dlm process recovery data() walks mres->ml[0..num locks) past the kmalloc(data len) copy of the message (an out-of-bounds read that ends in a BUG ON panic), and dlm init lockres() copies lockname len bytes into the fixed 32-byte o2dlm lockname slab object (a heap out-of-bounds write). Both are reachable by any node in the domain.

Validate these fields right after dlm grab(), before anything uses them -- including the not-joined error path, which already prints mres->lockname with the unbounded lockname len as a %.*s precision. Reject the message unless lockname len <= DLM LOCKID NAME MAX, num locks <= DLM MAX MIGRATABLE LOCKS (the bound the sender already asserts), and the payload is large enough to hold the claimed locks. Conforming recovery and migration messages are unaffected.