SB20260912304 - Missing Release of Resource after Effective Lifetime in Linux kernel ocfs2 cluster

Description

This security bulletin contains information about 1 vulnerability.

1) Missing Release of Resource after Effective Lifetime (CVE-ID: CVE-2026-89491)

CWE-ID: CWE-772 - Missing Release of Resource after Effective Lifetime

CVSSv4: 0 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a local user to leave heartbeat regions unprotected on subsequent mounts.

The vulnerability exists due to improper error handling in o2hb_region_inc_user() when heartbeat region pinning fails partway through processing. A local user can invoke heartbeat region user registration during a pinning failure to leave heartbeat regions unprotected on subsequent mounts.

Partially pinned regions are not released, and the dependent-user counter remains incremented.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/470212a5eefabcc16b8e2f7fe2844b8737fe571c
• https://git.kernel.org/stable/c/49002acc520c61002ad195894ac391c94317d3ba
• https://git.kernel.org/stable/c/af09df89db9a68a1d76df0f75667998135bc8d65
• https://git.kernel.org/stable/c/ce035f208d68b812d83e5482980f2b1c88a9cd94