DEBIAN-CVE-2026-89494

In the Linux kernel, the following vulnerability has been resolved:  ocfs2: validate lengths in dlmmiglockreshandler  A node receiving a DLMMIGLOCKRES message trusts several fields of the peer-supplied dlmmigratablelockres without validation.  numlocks and locknamelen are bounded only on the sending side, and the message is never checked to actually carry numlocks migratablelock entries.  As a result dlmprocessrecoverydata() walks mres->ml[0..numlocks) past the kmalloc(datalen) copy of the message (an out-of-bounds read that ends in a BUGON panic), and dlminitlockres() copies locknamelen bytes into the fixed 32-byte o2dlmlockname slab object (a heap out-of-bounds write).  Both are reachable by any node in the domain.  Validate these fields right after dlmgrab(), before anything uses them -- including the not-joined error path, which already prints mres->lockname with the unbounded locknamelen as a %.*s precision.  Reject the message unless locknamelen <= DLMLOCKIDNAMEMAX, numlocks <= DLMMAXMIGRATABLE_LOCKS (the bound the sender already asserts), and the payload is large enough to hold the claimed locks.  Conforming recovery and migration messages are unaffected.