CVE-2026-53309: Linux kernel ocfs2/DLM off-by-one error in region comparison

Overview

CVE-2026-53309 affects the ocfs2 Distributed Lock Manager (DLM) code in the Linux kernel. According to the record, the function dlm_match_regions() compares local and remote region lists with a loop condition of '<=' instead of '<', so the loop can read one entry past the end of qr_regions. The upstream fix changes the condition to '<' to match the other loops in the same function.

Sources: CVE record, NVD entry, stable commit 2a0673836f019e7c032acbf48d022d5ccf02a845.

Impact

The confirmed defect is a read beyond the valid range of an array in a kernel code path.
The CNA assigned CVSS 3.1 base score 9.8 (critical), with a network attack vector, no privileges required, no user interaction and high impact on confidentiality, integrity and availability.
The record does not explain how an attacker would reach this code path or what the out-of-bounds read exposes or breaks. Reading the scoring vector as a concrete attack scenario would be an inference.

Affected products and versions

The record lists the Linux kernel stable branches with these affected ranges:

From 2.6.37 up to, but not including, 5.10.258
From 5.11 up to, but not including, 5.15.209
From 5.16 up to, but not including, 6.1.175
From 6.2 up to, but not including, 6.6.141
From 6.7 up to, but not including, 6.12.91
From 6.13 up to, but not including, 6.18.33
From 6.19 up to, but not including, 7.0.10

The record does not state a fixed version for each branch. The upper bound of each range suggests the first fixed release in that branch, but administrators should confirm against their distribution's advisories.

Exploitation status

The record's KEV field shows that this CVE is not listed in the CISA Known Exploited Vulnerabilities catalog, so active exploitation is not claimed here. No confirmed exploitation appears in the sources consulted. The EPSS estimate in the record is 0.00399 (percentile 0.32249, dated 2026-10-13). This is a probability model, not evidence of exploitation.

Remediation and mitigation

Update the Linux kernel to a stable release that includes the fix for the affected branch, using the commits listed in the record as the reference for the fix.
Prioritize systems where the ocfs2 filesystem and its DLM component are in use, since the defect is in that code.
Follow your Linux distribution's security advisories to confirm the build that includes the backport for your kernel branch.

Detection guidance

Inventory kernel versions and compare them with the affected ranges above.
Check whether the ocfs2 module is loaded or in use on hosts, as this helps prioritize patching.
Review kernel logs for unexpected faults in ocfs2 or DLM code paths. The record does not describe specific log signatures, so any detection rule should be treated as a general hygiene check.

Limitations of the available information

The record does not describe the exact impact of the out-of-bounds read, such as memory disclosure or crash behavior.
Fixed versions per branch are not explicitly stated.
The sources consulted do not mention public exploit code or confirmed attacks.
The CVSS score comes from the CNA record, and the record does not show independent verification of it.

Frequently asked questions

What is the core defect in CVE-2026-53309?

According to the record, a region comparison loop in dlm_match_regions() uses '<=' instead of '<', so it reads one entry past the valid range of qr_regions. The fix changes the condition to '<'.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV, and no confirmed exploitation appears in the sources consulted.

What should administrators do first?

Inventory kernel versions against the affected ranges and apply the stable kernel update or distribution advisory that includes the fix for your branch.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.