CVE-2026-90322: ocfs2/cluster: keep heartbeat local node stable
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/cluster: keep heartbeat local node stable
o2nmnodelocalstore() handles local=0 by stopping o2net and setting cllocalnode to O2NMINVALIDNODENUM, but it leaves clhaslocal set. That stale state makes o2nmthisnode() return 255, blocks a later local=1 attempt with -EBUSY, and can feed 255 to heartbeat users that call o2nmthisnode() dynamically.
Clearing clhaslocal is required when the local node is reset. But heartbeat threads can still be running at that point. They pin the local node config item at startup, yet o2hbdodiskheartbeat() and thread teardown re-read o2nmthisnode() for the local slot and for o2nmundependthisnode(). Once local=0 has cleared the live local-node state, those dynamic reads return O2NMMAXNODES, which is also the invalid node number 255.
Store the local node number in the heartbeat region when the region starts. Use that stable node for heartbeat slot writes/checks, negotiation messages, and the final configfs undepend. Stop the heartbeat loop when the current local node no longer matches the stored node, and clear clhaslocal together with cllocalnode in the local=0 path so nodemanager state matches node removal.
Validation reproduced this kernel report: KASAN slab-out-of-bounds in o2hbdodiskheartbeat+0x372/0xb30 RIP: 0010:memset+0xf/0x20 Read of size 8 Call trace: dumpstacklvl+0x66/0xa0 printreport+0xd0/0x630 o2hbdodiskheartbeat+0x372/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) srsoaliasreturnthunk+0x5/0xfbef5 virtaddrvalid+0x188/0x2f0 kasanreport+0xe4/0x120 o2hbdodiskheartbeat+0x5/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) o2hbthread+0x14e/0x770 kthreadaffinenode+0x139/0x180 lockdephardirqsonprepare+0xda/0x190 tracehardirqson+0x18/0x130 kthread+0x19d/0x1e0 retfromfork+0x37a/0x4d0 switchto+0x2d5/0x6f0 retfromforkasm+0x1a/0x30
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372/0xb30
Event History
Frequently Asked Questions
Which systems are affected by this state-management issue?
Systems using the OCFS2 cluster stack can encounter it when the configured local node is reset to local=0 while heartbeat threads are still running. The stale local-node state can affect later attempts to set local=1 and heartbeat users that obtain the local node dynamically.
What symptoms indicate that the issue has occurred?
After local=0, o2nm_this_node() can return the invalid node number 255. A subsequent local=1 attempt can fail with -EBUSY, and heartbeat code may use node 255 for heartbeat slot handling or final configuration cleanup.
What operational condition is relevant during mitigation or configuration changes?
Avoid resetting the local-node setting while heartbeat activity remains in progress where possible. The fix stores a stable node number when a heartbeat region starts and stops the heartbeat loop if the current local node no longer matches that stored value.