CVE-2026-53309: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'. Fix the loop condition to use '<' for consistency and correctness.
Metrics
- CVSS v3.1
- 9.8
- Severity
- CRITICAL
- Fixed in
- 0
- Affected Products
- 2
HarborGuard Analysis
Synopsis
An off-by-one error in the Linux kernel's ocfs2 distributed lock manager (DLM) component allows a network-reachable attacker to read one entry past the valid boundary of the qr_regions array inside dlm_match_regions(). The vulnerability is reachable without authentication over the network and requires no user interaction. Successful exploitation grants full read, write, and crash capability against the affected host. A patched-image rebuild at the fix commit versions is available on HarborGuard for environments running an affected kernel version.
HarborGuard Coverage
Detection is available across every HarborGuard environment: the CVE is ingested from upstream Linux kernel security feeds within minutes of publication and matched against customer images, including custom-built images that carry affected kernel versions in their base layers or installed packages.
AvailableHarborGuard scores this finding at CVSS 9.8 Critical and weights it against each environment's compliance policy to determine escalation priority; findings are routed to the team inbox configured for the affected workload inside each customer organization.
AvailableA patched-image rebuild pinned to the fix commits (0, 01b61e8dda9b, 1fb7f356547d, 2a0673836f01, 426cd8eedac8) is available on HarborGuard for images confirmed to carry an affected kernel version. For customers who opt into auto-remediation, HarborGuard triggers a rebuild, runs a regression test suite against the new image, and opens a pull request against affected workloads automatically.
AvailableExploit Conditions
- Network reachabilityRequired
The attacker must reach the ocfs2 DLM service over the network; the CVSS vector specifies AV:N, meaning no local access or physical presence is needed.
- AuthenticationNot required
No credentials or session token are needed before triggering the out-of-bounds read; PR:N means any unauthenticated party with network access can attempt exploitation.
- Victim interactionNot required
The attacker does not need to trick or wait for any user action; UI:N means exploitation is fully attacker-driven.
- Attack complexityDetail
Attack complexity is Low (AC:L), meaning the exploit is reliable and requires no special race conditions, memory-layout knowledge, or environmental prerequisites beyond network reachability.
Blast Radius
- Reads kernel memory contents one region entry past the valid qr_regions boundary, exposing data that may include cryptographic material, session state, or other in-memory secrets.
- Writes or corrupts adjacent kernel memory, enabling an attacker to modify persisted lock state, file-system metadata, or kernel data structures.
- Crashes the affected kernel or the ocfs2/DLM subsystem, taking down any workloads dependent on the shared cluster file system.
- Full compromise of confidentiality, integrity, and availability is confirmed by the C:H/I:H/A:H impact tokens in the CVSS vector.
How HarborGuard Handles This
Available on HarborGuard: detection fires within minutes of CVE publication for any image found carrying a kernel version in the affected range. Given the Critical severity (CVSS 9.8), this CVE is prioritized at the top of the remediation queue. Where compliance policy permits auto-remediation, HarborGuard rebuilds the image at one of the upstream fix commits, executes a regression test run against the rebuilt image, and opens a pull request against the affected workload; median time from CVE publication to merged patch PR for Critical-severity issues is around 90 minutes for environments with auto-remediation enabled. For environments where auto-remediation is not enabled, the rebuilt image is staged and a triage alert is routed to the configured security inbox. Until a patched image is deployed, consider applying network policy to restrict access to the ocfs2 DLM port to trusted cluster nodes only, reducing the attack surface from an unauthenticated network-reachable exploit to a narrower trusted-LAN exposure.
Fix available
- Linux / Linux< 760ab35040aca8399021fdb9ff1db1089feb7194 (from ea2034416b54700e30371f2ad6517cbb94674083) · < c60a2710b73838d250cda57344c049b89abc5d52 (from ea2034416b54700e30371f2ad6517cbb94674083) · < 2a0673836f019e7c032acbf48d022d5ccf02a845 (from ea2034416b54700e30371f2ad6517cbb94674083) · < 819d8ebad3200a53de99bd7e297bc428e41ced54 (from ea2034416b54700e30371f2ad6517cbb94674083) · < d5403ae28085761d58b555645bc7d5feadb10073 (from ea2034416b54700e30371f2ad6517cbb94674083) · < 1fb7f356547d9688822315cd2b205ff0bd5429b4 (from ea2034416b54700e30371f2ad6517cbb94674083)
- Linux / Linux2.6.37Fixed in 0, 5.10.258, 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H