{"id":"CVE-2026-99204","kind":"vulnerability","aliases":["CVE-2026-99204"],"related":[],"title":"Linux kernel OCFS2 DLM: debugfs read can use freed recovery memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2/dlm: Protect the recovery list during debugfs reads\n\nRecovery participant records must remain alive while debug_state_print()\nwalks reco.node_data and formats their fields. The formatter holds\ndlm->spinlock, but the recovery participant list is protected by\ndlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches\nthe list under dlm_reco_state_lock and frees the detached records after\nreleasing it. A concurrent debugfs open can therefore read freed memory.\n\nProtect the participant traversal and field reads in debug_state_print()\nwith dlm_reco_state_lock, matching the existing list writers. This also\nserializes the traversal against list_add_tail() during recovery-area\ninitialization. Make the existing lock available to the debug code\nthrough dlmcommon.h; the lock remains internal to the OCFS2 DLM module.\n\nRelease dlm->spinlock after formatting the other domain state and before\nacquiring dlm_reco_state_lock, so the debug reader does not nest the two\nlocks. Leave recovery list insertion, detachment and freeing unchanged.\n\nKASAN report as below:\n\n    BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0\n    Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896\n\n    CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)\n    Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n    Call Trace:\n     <TASK>\n     dump_stack_lvl+0x93/0xd0\n     print_report+0xce/0x630\n     ? debug_state_open+0x1169/0x12d0\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __virt_addr_valid+0x20e/0x420\n     ? debug_state_open+0x1169/0x12d0\n     kasan_report+0xe0/0x110\n     ? debug_state_open+0x1169/0x12d0\n     debug_state_open+0x1169/0x12d0\n     ? __pfx_debug_state_open+0x10/0x10\n     full_proxy_open_regular+0x193/0x310\n     do_dentry_open+0x595/0x12d0\n     ? __pfx_full_proxy_open_regular+0x10/0x10\n     vfs_open_consume+0xd1/0x400\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     path_openat+0x18d0/0x2020\n     ? __pfx_path_openat+0x10/0x10\n     do_file_open+0x21e/0x470\n     ? __pfx_do_file_open+0x10/0x10\n     ? _raw_spin_unlock+0x23/0x40\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? alloc_fd+0x3a6/0x6b0\n     do_sys_openat2+0xf4/0x1b0\n     ? __pfx_do_sys_openat2+0x10/0x10\n     ? srso_alias_return_thunk+0x5/0xfbef5\n     ? __fput+0x5b5/0xa60\n     __x64_sys_openat+0x136/0x1e0\n     ? __pfx___x64_sys_openat+0x10/0x10\n     do_syscall_64+0x114/0x620\n     entry_SYSCALL_64_after_hwframe+0x77/0x7f\n    [Register dump omitted.]\n     </TASK>\n\n    Allocated by task 880:\n     kasan_save_stack+0x33/0x60\n     kasan_save_track+0x14/0x30\n     __kasan_kmalloc+0xaa/0xb0\n     __kmalloc_cache_noprof+0x28d/0x610\n     dlm_remaster_locks+0x147/0x1d90\n     dlm_do_recovery+0xde1/0x1580\n     dlm_recovery_thread+0x109/0x300\n     kthread+0x351/0x460\n     ret_from_fork+0x659/0x940\n     ret_from_fork_asm+0x1a/0x30\n\n    Freed by task 880:\n     kasan_save_stack+0x33/0x60\n     kasan_save_track+0x14/0x30\n     kasan_save_free_info+0x3b/0x60\n     __kasan_slab_free+0x5f/0x80\n     kfree+0x308/0x580\n     dlm_destroy_recovery_area+0x285/0x460\n     dlm_remaster_locks+0x17c4/0x1d90\n     dlm_do_recovery+0xde1/0x1580\n     dlm_recovery_thread+0x109/0x300\n     kthread+0x351/0x460\n     ret_from_fork+0x659/0x940\n     ret_from_fork_asm+0x1a/0x30\n\n    The buggy address belongs to the object at ffff88810662ef80\n     which belongs to the cache kmalloc-32 of size 32\n    The buggy address is located 0 bytes inside of\n     freed 32-byte region [ffff88810662ef80, ffff88810662efa0)\n\n    [Page and memory-state dumps omitted.]","summary":"In the Linux kernel's OCFS2 distributed lock manager, reading the debugfs state file can race with recovery teardown and read memory that was already freed. The sources describe a KASAN slab-use-after-free report and do not state a confirmed code-execution or data-disclosure outcome.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clustered-storage","infrastructure","linux-kernel","ocfs2"],"not_affected_if":["no-debugfs","ocfs2-not-loaded"],"how_to_check":"- `uname -r` to see the running kernel version, then compare against the fixed kernel in the advisory\n- Check whether the OCFS2 module is loaded with `lsmod | grep ocfs2`\n- Check whether debugfs is mounted with `mount | grep debugfs`","fix":"- Update the Linux kernel to a release that includes the upstream commit resolving ocfs2/dlm recovery list protection; the exact fixed version is unknown from the sources\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","triaged_at":"2026-10-28T11:33:58+00:00","updated_at":"2026-10-28T11:33:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-28T11:33:58Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit resolving ocfs2/dlm recovery list protection; the exact fixed version is unknown from the sources\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel OCFS2 DLM: debugfs read can use freed recovery memory","impact":"medium","summary":"In the Linux kernel's OCFS2 distributed lock manager, reading the debugfs state file can race with recovery teardown and read memory that was already freed. The sources describe a KASAN slab-use-after-free report and do not state a confirmed code-execution or data-disclosure outcome.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","ocfs2","clustered-storage"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user may read freed kernel memory, possibly crashing the host","analyst_note":"Confirm the fixed kernel version and whether the debugfs open path requires root, using the NVD entry and the upstream stable commit.","how_to_check":"- `uname -r` to see the running kernel version, then compare against the fixed kernel in the advisory\n- Check whether the OCFS2 module is loaded with `lsmod | grep ocfs2`\n- Check whether debugfs is mounted with `mount | grep debugfs`","needs_analyst":true,"not_affected_if":["ocfs2-not-loaded","no-debugfs"],"who_is_affected":"Systems running the Linux kernel with the OCFS2 shared-disk filesystem and its distributed lock manager in use, typically clustered storage nodes. The debugfs reader path is the trigger, so hosts without OCFS2 mounted or without debugfs exposed are unlikely to be affected. Single-node machines that never load ocfs2 can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000843,"input_tokens":5081,"output_tokens":670,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':264C,330C,334C,339C,345C,350C,355C,359C,364C,369C,375C,381C,386C,393C,398C,404C,408C,413C,418C,424C,429C,435C,439C,444C,450C,456C,459C,464C,470C,475C,482C,494C,499C,503C,508C,513C,518C,523C,526C,531C,537C,546C,551C,557C,562C,565C,571C,576C,581C,586C,589C,594C,600C '-2':323C '-2026':13A,16A '-32':617C '-99204':14A,17A '/896':279C '0':283C,626C '04/01/2014':324C '1':281C,303C '1.16.3':320C,322C '1996':318C '20260921':297C '24.04':310C '32':620C,631C '4':269C '64':474C,479C '7.3.0':293C '880':490C,542C '896':285C 'acquir':226C 'add':188C 'addr':271C,348C 'address':604C,623C 'alia':342C,401C,432C,453C 'aliv':100C 'alloc':437C,487C 'alreadi':50B 'also':182C 'arch':315C 'area':134C,193C,570C 'asm':536C,599C 'avail':199C 'belong':605C,612C 'bio':319C 'bug':253C 'buggi':603C,622C 'byte':627C,632C 'cach':506C,615C 'call':325C 'cap':316C 'cluster':19B 'clustered-storag':18B 'code':70B,203C 'code-execut':69B 'comm':286C 'concurr':152C 'confirm':68B 'consum':397C 'cpu':280C 'cve':12A,15A 'data':74B,107C 'data-disclosur':73B 'debian':321C 'debug':102C,168C,202C,233C,261C,336C,352C,361C,366C,372C 'debugf':5A,37B,93C,153C 'dentri':384C 'describ':54B 'destroy':132C,568C 'detach':135C,146C,245C 'disclosur':75B 'distribut':32B 'dlm':4A,115C,125C,131C,139C,172C,213C,216C,227C,276C,288C,510C,515C,520C,567C,573C,578C,583C 'dlm-state-str':275C,287C 'dlmcommon.h':205C 'domain':222C 'dump':327C,485C,641C 'entri':477C 'execut':71B 'exist':178C,197C 'fd':438C 'ffff88810662ef80':272C,610C,634C 'ffff88810662efa0':635C 'field':111C,165C 'file':39B,416C,422C 'fix':317C 'follow':82C 'fork':530C,535C,593C,598C 'format':109C,219C 'formatt':113C 'fput':458C 'free':61B,144C,247C,259C,555C,561C 'freed':9A,51B,158C,539C,630C 'full':377C,389C 'function':301C 'hardwar':306C 'hold':114C 'hwframe':481C 'i440fx':313C 'info':556C 'infrastructur':21B 'initi':194C 'insert':244C 'insid':628C 'intern':209C 'kasan':56B,249C,254C,357C,491C,496C,501C,543C,548C,553C,559C 'kernel':2A,24B,29B,80C 'kfree':564C 'kmalloc':502C,505C,616C 'kthread':525C,588C 'lazi':305C 'leav':241C 'linux':1A,23B,28B,79C 'linux-kernel':22B 'list':91C,121C,137C,179C,187C,243C 'locat':625C 'lock':33B,128C,142C,175C,198C,207C,230C,240C,512C,575C 'lvl':329C 'make':195C 'manag':34B 'match':176C 'memori':11A,47B,159C,639C 'memory-st':638C 'modul':214C 'must':98C 'name':307C 'nest':237C 'next':296C 'noprof':507C 'object':608C 'ocfs2':3A,25B,31B,212C,300C 'ocfs2/dlm':87C 'omit':486C,642C 'open':154C,263C,338C,354C,363C,368C,374C,379C,385C,391C,396C,417C,423C 'openat':407C,412C,463C,469C 'openat2':443C,449C 'outcom':76B 'page':636C 'particip':96C,120C,162C 'particular':130C 'path':406C,411C 'pc':311C 'pfx':371C,388C,410C,420C,446C,466C 'pid':284C 'piix':314C 'pmb':299C 'pmb-ocfs2-functional-v1':298C 'preempt':304C 'print':104C,170C,332C 'protect':88C,123C,160C 'proxi':378C,390C 'qemu':308C 'race':41B 'raw':426C 'rc4':295C 'rc4-next':294C 'read':6A,35B,46B,94C,157C,166C,266C 'reader':234C 'reco':126C,140C,173C,228C 'reco.node':106C 'record':97C,147C 'recoveri':10A,43B,90C,95C,119C,133C,192C,242C,517C,521C,569C,580C,584C 'recovery-area':191C 'region':633C 'regist':484C 'regular':380C,392C 'releas':149C,215C 'remain':99C,208C 'remast':511C,574C 'report':62B,250C,333C,358C 'resolv':86C 'ret':528C,533C,591C,596C 'return':343C,402C,433C,454C 'save':492C,497C,544C,549C,554C 'serial':183C 'size':268C,619C 'slab':58B,256C,560C 'slab-use-after-fre':57B,255C 'sourc':53B 'spin':427C 'spinlock':116C,217C 'srso':341C,400C,431C,452C 'stack':328C,493C,545C 'state':38B,66B,103C,127C,141C,169C,174C,223C,229C,262C,277C,289C,337C,353C,362C,367C,373C,640C 'storag':20B 'stres':278C,290C 'sys':442C,448C,462C,468C 'syscal':473C,478C 'tail':189C 'taint':292C 'task':274C,489C,541C 'teardown':44B 'therefor':156C 'thread':522C,585C 'thunk':344C,403C,434C,455C 'trace':326C 'track':498C,550C 'travers':163C,185C 'two':239C 'ubuntu':309C 'uid':282C 'unchang':248C 'unlock':428C 'use':8A,59B,257C 'v1':302C 'v2':312C 'valid':349C 'vfs':395C 'virt':347C 'vulner':83C 'walk':105C 'writer':180C 'x10/0x10':376C,394C,414C,425C,451C,471C 'x109/0x300':524C,587C 'x114/0x620':476C 'x1169/0x12d0':265C,340C,356C,365C,370C 'x136/0x1e0':465C 'x14/0x30':500C,552C 'x147/0x1d90':514C 'x17c4/0x1d90':577C 'x18d0/0x2020':409C 'x193/0x310':382C 'x1a/0x30':538C,601C 'x20e/0x420':351C 'x21e/0x470':419C 'x23/0x40':430C 'x285/0x460':572C 'x28d/0x610':509C 'x308/0x580':566C 'x33/0x60':495C,547C 'x351/0x460':527C,590C 'x3a6/0x6b0':440C 'x3b/0x60':558C 'x5/0xfbef5':346C,405C,436C,457C 'x595/0x12d0':387C 'x5b5/0xa60':460C 'x5f/0x80':563C 'x64':461C,467C 'x659/0x940':532C,595C 'x77/0x7f':483C 'x93/0xd0':331C 'xaa/0xb0':504C 'xce/0x630':335C 'xd1/0x400':399C 'xde1/0x1580':519C,582C 'xe0/0x110':360C 'xf4/0x1b0':445C","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel with the OCFS2 shared-disk filesystem and its distributed lock manager in use, typically clustered storage nodes. The debugfs reader path is the trigger, so hosts without OCFS2 mounted or without debugfs exposed are unlikely to be affected. Single-node machines that never load ocfs2 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:41+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99204","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99204","severity":null,"published_at":"2026-10-28T11:17:41+00:00","modified_at":"2026-10-28T11:17:41+00:00","first_seen_at":"2026-10-28T11:32:37+00:00","fetched_at":"2026-10-28T11:32:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}