CVE-2026-90301 (GCVE-0-2026-90301)

Vulnerability from cvelistv5 – Published: 2026-09-17 16:08 – Updated: 2026-09-18 17:54
VLAI
Title
ocfs2: o2hb: quiesce negotiate handlers and timeout work
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down. The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue(). Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg. The buggy scenario involves two paths, with each column showing the order within that path: region lifecycle: late negotiate callback: 1. make_item() registers the 1. o2net_process_message() gets a region handlers before heartbeat handler for reg. dev_store() has built a 2. The callback runs after the lookup runnable heartbeat context. lock is dropped and dereferences reg. 2. A failed start or rmdir 3. An approve or timeout path tries to stops the heartbeat thread, queue reg's delayed work, or release quiesces existing work, and races the callback body after handler drops the final configfs ref. unregister. 3. region_release() must drain 4. The callback or delayed work can handler-visible o2net rx work outlive reg unless lifecycle code before freeing reg. keeps the region non-armable and drains the active-or-destroying o2net workqueue. Validation reproduced this kernel report: KASAN slab-use-after-free in __run_timers+0x22c/0x5b0 Write of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 __run_timers+0x22c/0x5b0 kasan_report+0xe0/0x110 _raw_spin_unlock_irqrestore+0x27/0x60 try_to_wake_up+0x191/0xf70 timer_expire_remote+0xae/0xf0 run_timer_softirq+0x19b/0x1a0 handle_softirqs+0x156/0x660 __irq_exit_rcu+0xc4/0x160 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x6c/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 Allocated by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 o2hb_heartbeat_group_make_item+0x3c/0x600
Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 34069b886f95356d68bf8315fa648c4ab3193cdd , < b5a2907bdeced0949bcddc84b95ba7d4cb93841b (git)
Affected: 34069b886f95356d68bf8315fa648c4ab3193cdd , < 011291b70ba4832e136b7b581825b2bc0f525bf6 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.7
Unaffected: 0 , < 4.7 (semver)
Unaffected: 7.2.6 , ≤ 7.2.* (semver)
Unaffected: 7.3-rc1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/tcp.c",
            "fs/ocfs2/cluster/tcp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
              "status": "affected",
              "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
              "versionType": "git"
            },
            {
              "lessThan": "011291b70ba4832e136b7b581825b2bc0f525bf6",
              "status": "affected",
              "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/tcp.c",
            "fs/ocfs2/cluster/tcp.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.6",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3-rc1",
                  "versionStartIncluding": "4.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: o2hb: quiesce negotiate handlers and timeout work\n\nHeartbeat regions publish struct o2hb_region as the private data for the\nNEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()\ncreates the configfs region.  The approve handler can call\no2hb_arm_timeout(), so a peer can touch the region timeout work before\ndev_store() has finished building the heartbeat runtime, or after teardown\nhas started to shut that runtime back down.\n\nThe final configfs put also has to keep reg alive until the last in-flight\no2net callback drops its handler reference. \no2net_unregister_handler_list() blocks future handler lookups, but it does\nnot wait for sc_rx_work that already passed o2net_handler_get().  That\ndrain needs to cover local listener teardown as well, where the o2net\nordered workqueue may already be inside destroy_workqueue().\n\nFix the lifetime rule in both directions.  Initialize the region delayed\nworks before publishing reg through the o2net handler table, keep new or\nstopping regions non-armable with hr_stopping, and quiesce both delayed\nworks on failed-start and teardown paths even when no heartbeat thread is\nleft to call o2hb_disarm_timeout().  Then unregister handlers before\ntearing down handler-visible region state and make the drain wait for the\nactive or destroying o2net ordered workqueue before release frees reg.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nregion lifecycle:                late negotiate callback:\n1. make_item() registers the     1. o2net_process_message() gets a\n   region handlers before           heartbeat handler for reg.\n   dev_store() has built a       2. The callback runs after the lookup\n   runnable heartbeat context.      lock is dropped and dereferences reg.\n2. A failed start or rmdir       3. An approve or timeout path tries to\n   stops the heartbeat thread,      queue reg\u0027s delayed work, or release\n   quiesces existing work, and      races the callback body after handler\n   drops the final configfs ref.    unregister.\n3. region_release() must drain   4. The callback or delayed work can\n   handler-visible o2net rx work    outlive reg unless lifecycle code\n   before freeing reg.              keeps the region non-armable and\n                                    drains the active-or-destroying\n                                    o2net workqueue.\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in __run_timers+0x22c/0x5b0\nWrite of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  __run_timers+0x22c/0x5b0\n  kasan_report+0xe0/0x110\n  _raw_spin_unlock_irqrestore+0x27/0x60\n  try_to_wake_up+0x191/0xf70\n  timer_expire_remote+0xae/0xf0\n  run_timer_softirq+0x19b/0x1a0\n  handle_softirqs+0x156/0x660\n  __irq_exit_rcu+0xc4/0x160\n  irq_exit_rcu+0xe/0x20\n  sysvec_apic_timer_interrupt+0x6c/0x80\n  asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  o2hb_heartbeat_group_make_item+0x3c/0x600"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - O2HB_NEGO_APPROVE_MSG and O2HB_NEGO_TIMEOUT_MSG arrive as o2net TCP payloads. o2net_data_ready queues sc_rx_work; o2net_rx_until_empty \u2192 o2net_advance_rx \u2192 o2net_process_message looks up the handler by msg_type and hr_key and calls o2hb_nego_approve_handler or o2hb_nego_timeout_handler, so the peer supplies the triggering bytes on a routable IPv4 TCP session.\nAC:H - Memory corruption requires the region to be between o2hb_heartbeat_group_make_item() publishing handlers (hr_steady_iterations still 0, delayed work uninitialized) and INIT_DELAYED_WORK in o2hb_region_dev_store(), or o2net_handler_get() racing o2hb_region_release()\u0027s kfree. The peer sends NEGO_APPROVE but cannot mkdir/rmdir the configfs region that opens those windows.\nPR:N - o2net_accept_one admits the TCP peer after o2nm_get_node_by_ip() and o2hb_check_node_heartbeating_from_callback(); o2net_check_handshake only compares protocol version and idle/keepalive/heartbeat timeouts. No user login or capability check runs before o2hb_nego_approve_handler, so no account on the victim is required.\nUI:N - Once an o2net session exists, the attacker triggers the bug by sending O2HB_NEGO_APPROVE_MSG. Configfs heartbeat-region create or rmdir is cluster bring-up or shutdown timing, not a victim action such as mounting a filesystem or opening a file.\nS:U - The UAF writes the freed o2hb_region from o2hb_arm_timeout() and __run_timers stay in the host kernel on that cluster node and do not cross a guest-to-host, VM, or IOMMU boundary.\nC:H - KASAN reported a slab-use-after-free of the o2hb_region allocated by o2hb_heartbeat_group_make_item. o2hb_nego_timeout_handler still reads hr_nego_node_bitmap and config_item_name after free, and reclaiming the slab gives the attacker the freed object contents, enabling disclosure of adjacent kernel memory.\nI:H - o2hb_nego_approve_handler calls o2hb_arm_timeout(), which schedule_delayed_work\u0027s hr_write_timeout_work and hr_nego_timeout_work on a not-yet-initialized or already-freed o2hb_region. The reproduced bug is an 8-byte write in __run_timers on that freed object, a UAF write that can hijack kernel control flow.\nA:H - The UAF write in __run_timers runs from run_timer_softirq and oopses the node. If the wrongly armed hr_write_timeout_work fires, o2hb_write_timeout() also calls o2quo_disk_timeout() \u2192 o2quo_fence_self(), fencing the victim."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-18T17:54:25.849Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b5a2907bdeced0949bcddc84b95ba7d4cb93841b"
        },
        {
          "url": "https://git.kernel.org/stable/c/011291b70ba4832e136b7b581825b2bc0f525bf6"
        }
      ],
      "title": "ocfs2: o2hb: quiesce negotiate handlers and timeout work",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-90301",
    "datePublished": "2026-09-17T16:08:25.152Z",
    "dateReserved": "2026-09-11T19:38:34.799Z",
    "dateUpdated": "2026-09-18T17:54:25.849Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90301",
      "date": "2026-09-25",
      "epss": "0.00454",
      "percentile": "0.36758"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-24T01:51:38.000Z",
      "cve": "CVE-2026-90301",
      "id": "msrc_CVE-2026-90301",
      "initial_release_date": "2026-09-19T01:11:48.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "ocfs2: o2hb: quiesce negotiate handlers and timeout work",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-90301.json",
      "version": "4"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/cluster/heartbeat.c",
                  "fs/ocfs2/cluster/tcp.c",
                  "fs/ocfs2/cluster/tcp.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
                    "status": "affected",
                    "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "011291b70ba4832e136b7b581825b2bc0f525bf6",
                    "status": "affected",
                    "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "fs/ocfs2/cluster/heartbeat.c",
                  "fs/ocfs2/cluster/tcp.c",
                  "fs/ocfs2/cluster/tcp.h"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.7"
                  },
                  {
                    "lessThan": "4.7",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.6",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3-rc1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: o2hb: quiesce negotiate handlers and timeout work\n\nHeartbeat regions publish struct o2hb_region as the private data for the\nNEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()\ncreates the configfs region.  The approve handler can call\no2hb_arm_timeout(), so a peer can touch the region timeout work before\ndev_store() has finished building the heartbeat runtime, or after teardown\nhas started to shut that runtime back down.\n\nThe final configfs put also has to keep reg alive until the last in-flight\no2net callback drops its handler reference. \no2net_unregister_handler_list() blocks future handler lookups, but it does\nnot wait for sc_rx_work that already passed o2net_handler_get().  That\ndrain needs to cover local listener teardown as well, where the o2net\nordered workqueue may already be inside destroy_workqueue().\n\nFix the lifetime rule in both directions.  Initialize the region delayed\nworks before publishing reg through the o2net handler table, keep new or\nstopping regions non-armable with hr_stopping, and quiesce both delayed\nworks on failed-start and teardown paths even when no heartbeat thread is\nleft to call o2hb_disarm_timeout().  Then unregister handlers before\ntearing down handler-visible region state and make the drain wait for the\nactive or destroying o2net ordered workqueue before release frees reg.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nregion lifecycle:                late negotiate callback:\n1. make_item() registers the     1. o2net_process_message() gets a\n   region handlers before           heartbeat handler for reg.\n   dev_store() has built a       2. The callback runs after the lookup\n   runnable heartbeat context.      lock is dropped and dereferences reg.\n2. A failed start or rmdir       3. An approve or timeout path tries to\n   stops the heartbeat thread,      queue reg\u0027s delayed work, or release\n   quiesces existing work, and      races the callback body after handler\n   drops the final configfs ref.    unregister.\n3. region_release() must drain   4. The callback or delayed work can\n   handler-visible o2net rx work    outlive reg unless lifecycle code\n   before freeing reg.              keeps the region non-armable and\n                                    drains the active-or-destroying\n                                    o2net workqueue.\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in __run_timers+0x22c/0x5b0\nWrite of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  __run_timers+0x22c/0x5b0\n  kasan_report+0xe0/0x110\n  _raw_spin_unlock_irqrestore+0x27/0x60\n  try_to_wake_up+0x191/0xf70\n  timer_expire_remote+0xae/0xf0\n  run_timer_softirq+0x19b/0x1a0\n  handle_softirqs+0x156/0x660\n  __irq_exit_rcu+0xc4/0x160\n  irq_exit_rcu+0xe/0x20\n  sysvec_apic_timer_interrupt+0x6c/0x80\n  asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  o2hb_heartbeat_group_make_item+0x3c/0x600"
          }
        ],
        "id": "CVE-2026-90301",
        "lastModified": "2026-09-18T18:17:52.677",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "HIGH",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 8.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.2,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-09-17T17:17:27.603",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/011291b70ba4832e136b7b581825b2bc0f525bf6"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b5a2907bdeced0949bcddc84b95ba7d4cb93841b"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.