CVE-2026-53043: Linux kernel ocfs2 DLM - missing bounds check in dlm_match_regions()
The Linux kernel ocfs2 distributed lock manager uses the qr_numregions field of incoming DLM_QUERY_REGION messages as loop bounds without checking it first. According to the record, a crafted message can cause out-of-bounds memory access, and the CNA rates it Critical with CVSS 3.1 score 9.1. The record lists stable kernel fix commits, and no confirmed exploitation appears in the sources consulted.
Overview
CVE-2026-53043 affects the ocfs2 distributed lock manager (DLM) code in the Linux kernel. The function dlm_match_regions() uses the qr_numregions field from a DLM_QUERY_REGION network message as loop bounds without checking it against O2NM_MAX_REGIONS, the maximum number of regions the qr_regions buffer is sized for. The record indicates the fix adds a bounds check before the loops run.
Impact
- According to the record's description, a crafted message with qr_numregions above 32 can cause out-of-bounds reads past the qr_regions buffer.
- The CNA assigns a CVSS 3.1 base score of 9.1 (Critical) with vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H, which describes network reachability without privileges or user interaction, with high confidentiality and availability impact.
- The assigned CWE is CWE-787 (Out-of-bounds Write), while the description refers to out-of-bounds reads. This difference is not resolved by the record.
Affected products and versions
The record lists the Linux kernel with these ranges:
- from 2.6.37 before 5.10.258
- from 5.11 before 5.15.209
- from 5.16 before 6.1.175
- from 6.2 before 6.6.141
- from 6.7 before 6.12.91
- from 6.13 before 6.18.33
- from 6.19 before 7.0.10
The record includes eight stable kernel commit references. It does not state which commit applies to which branch.
Exploitation status
The record shows this CVE is not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted. EPSS data is not available in the record.
Remediation and mitigation
- Update to a stable kernel release from the branch that matches your kernel series, as indicated by the referenced stable commits.
- Prioritize systems that use ocfs2 with DLM networking, since the flawed code path belongs to that subsystem.
- After updating, verify the running kernel version against the affected ranges.
Detection guidance
- Inventory hosts running Linux kernels in the affected ranges and determine whether the ocfs2 filesystem and its DLM components are in use.
- Review kernel logs on cluster nodes for unexpected ocfs2 or DLM errors. The record does not describe specific log signatures.
- Monitor traffic reaching ocfs2 cluster nodes for connections from untrusted sources as a defense-in-depth measure.
Limitations of the available information
- The record does not state the exact fixed version for each branch, only the affected ranges and commit links.
- The record does not describe proof-of-concept details, and this analysis does not provide any.
- The difference between out-of-bounds read (description) and out-of-bounds write (CWE) is unresolved.
- The record does not state whether ocfs2 is enabled in default kernel configurations.
Frequently asked questions
Is this vulnerability known to be actively exploited?
The record shows the CVE is not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
What should administrators do first?
Identify hosts running affected Linux kernel ranges that use ocfs2 with DLM, then update to a stable kernel release from the matching branch and verify the running version.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.