ocfs2: o2hb: quiesce negotiate handlers and timeout work
In the Linux kernel, the following vulnerability has been resolved: ocfs2: o2hb: quiesce negotiate handlers and timeout work Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down. The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue(). Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg. The buggy scenario involves two paths, with each column showing the order within that p
CVE-2026-90301
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90301
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"lessThan": "b672d4de13247369c8dc394ba83f2a896d9cc25c",
"versionType": "git"
},
{
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"lessThan": "f218d70f27bb326f5e9b2f33503e253851b3bafa",
"versionType": "git"
},
{
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"lessThan": "9d44822ba34d6035690f725f9de602744a6e1946",
"versionType": "git"
},
{
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"lessThan": "b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
"versionType": "git"
},
{
"status": "affected",
"version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
"lessThan": "011291b70ba4832e136b7b581825b2bc0f525bf6",
"versionType": "git"
}
],
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "4.7"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "4.7",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.160",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.114",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.57",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90301
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #48654 · Revision 1
- Added to Heist Feed
- Publisher date