CVE-2026-90301
High · 8.1CVSS
8.1
EPSS
0.6%
Published
Sep 17, 2026
CISA due date
—
Cloudanix analysis
A timing flaw in Linux clustered storage software can let attackers crash servers or take them over by racing network messages against region shutdown.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- High
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Race Condition
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Race condition in OCFS2 heartbeat region lifecycle allows o2net handlers and delayed timeout work to dereference or modify a freed o2hb_region structure, resulting in slab use-after-free during timer processing.
Why it matters to the business
Systems running OCFS2 clustered storage can experience kernel crashes or memory corruption that may be escalated to arbitrary code execution, causing unplanned downtime and potential full host compromise in shared storage environments.
How an attack unfolds
An attacker with the ability to trigger repeated OCFS2 region creation, failed starts, or teardown operations while concurrent network heartbeat messages arrive can win the race between handler registration and workqueue drain, leaving dangling references that are later used after the region is freed.
How to fix it
Apply the upstream kernel patch that initializes delayed works before handler publication, introduces hr_stopping guards, drains the o2net ordered workqueue before release, and unregisters handlers prior to freeing region state. Rebuild and deploy the fixed kernel on all nodes using OCFS2.
How to confirm the fix worked
Confirm the patch is present by inspecting the o2hb and o2net source for hr_stopping checks, workqueue drain calls before region_release, and handler unregistration ordering. Reproduce the original KASAN report under load to verify absence of use-after-free.
Typical attack path
- Create or remove OCFS2 heartbeat regions rapidly via configfs while the cluster is under network load
- Force o2net message processing to occur after the region has begun teardown but before the workqueue is fully drained
- Trigger delayed timer or approve paths that touch the now-freed region structure
- Cause slab use-after-free during timer softirq execution leading to crash or controlled memory write
How to detect it
Search kernel logs for KASAN slab-use-after-free reports referencing __run_timers and o2hb_heartbeat_group_make_item. Correlate with OCFS2 configfs region creation or removal events and o2net message processing around the same time.
What your security team should do
- Prioritize patching kernel packages on all OCFS2 cluster nodes within the next maintenance window
- Monitor upstream stable and distribution kernel updates for the ocfs2 lifetime fix
- Restrict OCFS2 usage to trusted cluster networks until patches are applied
The record
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down. The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue(). Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg. The buggy scenario involves two paths, with each column showing the order within that path: region lifecycle: late negotiate callback: 1. make_item() registers the 1. o2net_process_message() gets a region handlers before heartbeat handler for reg. dev_store() has built a 2. The callback runs after the lookup runnable heartbeat context. lock is dropped and dereferences reg. 2. A failed start or rmdir 3. An approve or timeout path tries to stops the heartbeat thread, queue reg's delayed work, or release quiesces existing work, and races the callback body after handler drops the final configfs ref. unregister. 3. region_release() must drain 4. The callback or delayed work can handler-visible o2net rx work outlive reg unless lifecycle code before freeing reg. keeps the region non-armable and drains the active-or-destroying o2net workqueue. Validation reproduced this kernel report: KASAN slab-use-after-free in __run_timers+0x22c/0x5b0 Write of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 __run_timers+0x22c/0x5b0 kasan_report+0xe0/0x110 _raw_spin_unlock_irqrestore+0x27/0x60 try_to_wake_up+0x191/0xf70 timer_expire_remote+0xae/0xf0 run_timer_softirq+0x19b/0x1a0 handle_softirqs+0x156/0x660 __irq_exit_rcu+0xc4/0x160 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x6c/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20 Allocated by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 o2hb_heartbeat_group_make_item+0x3c/0x600
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|