CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: validate lengths in dlmmiglockres_handler

A node receiving a DLMMIGLOCKRES message trusts several fields of the

peer-supplied dlmmigratablelockres without validation.  num_locks and

lockname_len are bounded only on the sending side, and the message is

never checked to actually carry numlocks migratablelock entries.  As a

result dlmprocessrecoverydata() walks mres->ml[0..numlocks) past the

kmalloc(data_len) copy of the message (an out-of-bounds read that ends in

a BUGON panic), and dlminitlockres() copies locknamelen bytes into the

fixed 32-byte o2dlm_lockname slab object (a heap out-of-bounds write). 

Both are reachable by any node in the domain.

Validate these fields right after dlm_grab(), before anything uses them --

including the not-joined error path, which already prints mres->lockname

with the unbounded lockname_len as a %.*s precision.  Reject the message

unless locknamelen <= DLMLOCKIDNAMEMAX, num_locks <=

DLMMAXMIGRATABLE_LOCKS (the bound the sender already asserts), and the

payload is large enough to hold the claimed locks.  Conforming recovery

and migration messages are unaffected.