CVE-2026-53043: ocfs2/dlm: validate qr_numregions in dlm_match_regions()

Synopsis

An out-of-bounds read vulnerability exists in the Linux kernel's ocfs2/dlm subsystem, specifically in the dlm_match_regions() function. A remote attacker with network access to the DLM_QUERY_REGION service can send a crafted message with an inflated qr_numregions field (up to 255) to drive loop iteration past the 1024-byte qr_regions buffer, which holds at most 32 valid entries. Successful exploitation reads kernel memory beyond the buffer boundary, disclosing sensitive data and potentially causing a kernel crash. Patched-image rebuilds at fix version 5.10.258 and the corresponding upstream commits are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the DLM_QUERY_REGION service over the network; AV:N indicates the vulnerable code path is exposed via a network-accessible interface.

• AuthenticationNot required

  No credentials or account are needed; PR:N means the attacker sends a crafted DLM_QUERY_REGION message without authenticating.

• Victim interactionNot required

  No user or administrator action is required to trigger the vulnerability; the crafted network message is processed automatically by the kernel.

• Attack complexityDetail

  AC:L indicates the exploit is reliable and condition-free, requiring no race conditions, memory-layout guessing, or special environmental setup.

Blast Radius

• Reads kernel memory contents beyond the qr_regions buffer, which may expose in-memory data such as DLM state, region metadata, or adjacent kernel structures to the attacker.
• Abnormal memory access from iterating past buffer bounds can destabilize the kernel, causing a kernel oops or system crash and disrupting all workloads on the affected node.
• In a shared ocfs2 cluster, a single compromised or malicious peer node can send the crafted message to other cluster nodes, amplifying the impact across the storage cluster.