CVE-2026-99204— ocfs2/dlm: Protect the recovery list during debugfs reads
Quick assessment
Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Linux 内核中，以下漏洞已得到修复： ocfs2/dlm：在 debugfs 读取时保护恢复列表（recovery list） 在 遍历 并格式化其字段期间，恢复参与者（recovery participant）记录必须保持有效。虽然格式化器持有 ，但恢复参与者列表实际上是由 保护的。具体而言， 会在持有 的情况下将记录从列表中解离（detach），并在释放该锁之后才释放这些已解离的记录。因此，并发执行的 debugfs 打开操作可能会读取到已被释放的内存。 修复方案：使用 保护 中的参与者遍历及字段读取操
Possible ATT&CK Techniques 1 AI
T1068 · Exploitation for Privilege EscalationAffected Version Matrix 8
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Linux | Linux | 007dce53a29ccffc000ab5373d188f73881390fd< 04d4571c00db61a9664f387752fa05cb3c08a537 |
affected |
007dce53a29ccffc000ab5373d188f73881390fd< 2bc426a32bfb78868c7f76d9547132837b6b5284 |
affected | ||
007dce53a29ccffc000ab5373d188f73881390fd< 4c435828932bf46f29860e4a0375bcae101b778a |
affected | ||
2.6.26 |
affected | ||
< 2.6.26 |
unaffected | ||
6.18.59≤ 6.18.* |
unaffected | ||
7.2.13≤ 7.2.* |
unaffected | ||
7.3≤ * |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-99204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ocfs2/dlm: Protect the recovery list during debugfs reads
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: Protect the recovery list during debugfs reads
Recovery participant records must remain alive while debug_state_print()
walks reco.node_data and formats their fields. The formatter holds
dlm->spinlock, but the recovery participant list is protected by
dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches
the list under dlm_reco_state_lock and frees the detached records after
releasing it. A concurrent debugfs open can therefore read freed memory.
Protect the participant traversal and field reads in debug_state_print()
with dlm_reco_state_lock, matching the existing list writers. This also
serializes the traversal against list_add_tail() during recovery-area
initialization. Make the existing lock available to the debug code
through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.
Release dlm->spinlock after formatting the other domain state and before
acquiring dlm_reco_state_lock, so the debug reader does not nest the two
locks. Leave recovery list insertion, detachment and freeing unchanged.
KASAN report as below:
BUG: KASAN: slab-use-after-free in debug_state_open+0x1169/0x12d0
Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896
CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1+ #1 PREEMPT(lazy)
Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl+0x93/0xd0
print_report+0xce/0x630
? debug_state_open+0x1169/0x12d0
? srso_alias_return_thunk+0x5/0xfbef5
? __virt_addr_valid+0x20e/0x420
? debug_state_open+0x1169/0x12d0
kasan_report+0xe0/0x110
? debug_state_open+0x1169/0x12d0
debug_state_open+0x1169/0x12d0
? __pfx_debug_state_open+0x10/0x10
full_proxy_open_regular+0x193/0x310
do_dentry_open+0x595/0x12d0
? __pfx_full_proxy_open_regular+0x10/0x10
vfs_open_consume+0xd1/0x400
? srso_alias_return_thunk+0x5/0xfbef5
path_openat+0x18d0/0x2020
? __pfx_path_openat+0x10/0x10
do_file_open+0x21e/0x470
? __pfx_do_file_open+0x10/0x10
? _raw_spin_unlock+0x23/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? alloc_fd+0x3a6/0x6b0
do_sys_openat2+0xf4/0x1b0
? __pfx_do_sys_openat2+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? __fput+0x5b5/0xa60
__x64_sys_openat+0x136/0x1e0
? __pfx___x64_sys_openat+0x10/0x10
do_syscall_64+0x114/0x620
entry_SYSCALL_64_after_hwframe+0x77/0x7f
[Register dump omitted.]
</TASK>
Allocated by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
__kasan_kmalloc+0xaa/0xb0
__kmalloc_cache_noprof+0x28d/0x610
dlm_remaster_locks+0x147/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
Freed by task 880:
kasan_save_stack+0x33/0x60
kasan_save_track+0x14/0x30
kasan_save_free_info+0x3b/0x60
__kasan_slab_free+0x5f/0x80
kfree+0x308/0x580
dlm_destroy_recovery_area+0x285/0x460
dlm_remaster_locks+0x17c4/0x1d90
dlm_do_recovery+0xde1/0x1580
dlm_recovery_thread+0x109/0x300
kthread+0x351/0x460
ret_from_fork+0x659/0x940
ret_from_fork_asm+0x1a/0x30
The buggy address belongs to the object at ffff88810662ef80
which belongs to the cache kmalloc-32 of size 32
The buggy address is located 0 bytes inside of
freed 32-byte region [ffff88810662ef80, ffff88810662efa0)
[Page and memory-state dumps omitted.]
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-99204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-99204
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-99204 (3)
Same Patch Batch · Linux · 2026-10-28 · 117 CVEs total
| CVE-2026-99143 | tracing: Keep the predicate limit separate from program capacity | |
| CVE-2026-99129 | selinux: fix BPF token permission checks | |
| CVE-2026-99130 | io_uring/cancel: don't spin on local work the task can't run | |
| CVE-2026-99131 | xfs: fix capability check in xfs | |
| CVE-2026-99133 | net/iucv: fix the recvmsg window update | |
| CVE-2026-99132 | xfs: don't hold buffer locks across sync transaction commit in xfs_sync_sb_buf | |
| CVE-2026-99134 | mac802154: fix data race and NULL deref on local->assoc_dev | |
| CVE-2026-99135 | dm-integrity: fix infinite loop on discard with large tag size | |
| CVE-2026-99137 | cifs: don't update i_size in cifs_do_truncate without a cached handle | |
| CVE-2026-99136 | dm-crypt: fix a tiny race condition in crypt_dec_pending | |
| CVE-2026-99138 | tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) | |
| CVE-2026-99140 | tracing: Fix hist trigger timestamps for buffered events | |
| CVE-2026-99139 | tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) | |
| CVE-2026-99141 | tracing: Fix crash in print_graph_function_event() | |
| CVE-2026-99142 | tracing: Check operator stack capacity before pushing | |
| CVE-2026-99154 | scsi: libiscsi: Reject a negative task index from parse_pdu_itt | |
| CVE-2026-99151 | drm/amd/display: Fix NULL sink dereference in USB4 bandwidth functions | |
| CVE-2026-99153 | scsi: libiscsi: Validate the ITT reflected in a Reject PDU | |
| CVE-2026-99152 | scsi: libiscsi: Validate the task named by a management response | |
| CVE-2026-99150 | drm/amdgpu: don't drop the runtime PM reference twice in amdgpu_gpr |
Showing top 20 of 117 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
-
CVE-2026-99215
power: supply: core: prevent unregistering a power supply wh -
CVE-2026-99216
Drivers: hv: Don't reset VMBus connection state on error/exi -
CVE-2026-99214
drm/vc4: hdmi: Move packet RAM enable to PM runtime -
CVE-2026-99213
vsock: treat TCP_CLOSING as once-established -
CVE-2026-99212
net/rds: don't let the rdma_cm destroy an id RDS still owns
Same vendor: Linux
-
CVE-2026-99215
power: supply: core: prevent unregistering a power supply wh -
CVE-2026-99216
Drivers: hv: Don't reset VMBus connection state on error/exi -
CVE-2026-99214
drm/vc4: hdmi: Move packet RAM enable to PM runtime -
CVE-2026-99213
vsock: treat TCP_CLOSING as once-established -
CVE-2026-99212
net/rds: don't let the rdma_cm destroy an id RDS still owns