Heap-based buffer overflow in Linux kernel - CVE-2026-89495

Vulnerability details

The vulnerability allows a remote user to corrupt memory or cause a denial of service.

The vulnerability exists due to a heap-based buffer overflow in dlm_mig_lockres_handler when processing recovery data with an oversized lock name. A remote user can send a malformed recovery message with an oversized lock name length to corrupt memory or cause a denial of service.

Affected software

How to mitigate CVE-2026-89495

External References

• https://git.kernel.org/stable/c/2487bea2098322669f0563baff53e797486b823f
• https://git.kernel.org/stable/c/de10cd3b062a5235af754925fcf49beb5a1109d4
• https://git.kernel.org/stable/c/ea5b5609305a8437bc955a0834a530c12246d78f
• https://git.kernel.org/stable/c/f8658ee3327f73bd81c0bcd07cdeb5a8527fac98

Related Security Bulletins

• Heap-based buffer overflow in Linux kernel ocfs2 dlm