CVE-2026-53043: ocfs2/dlm: validate qr_numregions in dlm_match_regions()
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: validate qrnumregions in dlmmatchregions()
Patch series "ocfs2/dlm: fix two bugs in dlmmatchregions()".
In dlmmatchregions(), the qrnumregions field from a DLMQUERYREGION network message is used to drive loops over the qrregions buffer without sufficient validation. This series fixes two issues:
- Patch 1 adds a bounds check to reject messages where qrnumregions exceeds O2NMMAXREGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qrnumregions up to 255 and trigger out-of-bounds reads past the 1024-byte qrregions buffer.
- Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qrnumregions is within bounds.
This patch (of 2):
The qrnumregions field from a DLMQUERYREGION network message is used directly as loop bounds in dlmmatchregions() without checking against O2NMMAXREGIONS. Since qrregions is sized for at most O2NMMAXREGIONS (32) entries, a crafted message with qrnumregions > 32 causes out-of-bounds reads past the qrregions buffer.
Add a bounds check for qrnumregions before entering the loops.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ocfs2/dlmto a version that resolves this vulnerability.Patch ocfs2/dlm: fix two bugs in dlm_match_regions() - Configuration
Add a bounds check for qr_numregions before entering loops in dlm_match_regions() so that qr_numregions cannot exceed the maximum size of the qr_regions buffer (O2NM_MAX_REGIONS / qr_regions sized for at most O2NM_MAX_REGIONS).
ocfs2/dlm (dlm_match_regions()) qr_numregions bounds validation vs O2NM_MAX_REGIONS = reject DLM_QUERY_REGION messages where qr_numregions exceeds O2NM_MAX_REGIONS - Configuration
Fix the off-by-one in the local-vs-remote comparison loop in dlm_match_regions() by correcting the loop condition (use '<' instead of '<=' to prevent one extra out-of-bounds read).
ocfs2/dlm (dlm_match_regions()) local-vs-remote comparison loop bound = use '<' instead of '<=' (avoid reading one entry past the valid range)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53043?
CVE-2026-53043 has been rated with a critical severity score of 9.1.
How do I fix CVE-2026-53043?
To mitigate CVE-2026-53043, you should update your Linux kernel to the latest patched version that resolves the vulnerability.
What are the potential impacts of CVE-2026-53043?
CVE-2026-53043 could lead to denial of service conditions due to improper validation in the kernel's DLM component.
Which software is affected by CVE-2026-53043?
CVE-2026-53043 specifically affects the Linux kernel and the OCFS2 DLM subsystem.
What is the nature of CVE-2026-53043?
CVE-2026-53043 is a vulnerability that involves insufficient validation of the qr_numregions field in the dlm_match_regions function.