ocfs2: synchronize heartbeat callbacks with o2net teardown
In the Linux kernel, the following vulnerability has been resolved: ocfs2: synchronize heartbeat callbacks with o2net teardown Patch series "ocfs2: harden heartbeat teardown races". This series fixes two OCFS2 heartbeat/o2net teardown races found by KASAN. This patch (of 2): Heartbeat callbacks stay registered while configfs local-node teardown enters o2net_stop_listening(). A node-down event can still run through o2net_disconnect_node() and o2net_set_nn_state() while teardown is destroying o2net_wq, so the later queue/flush operations can hit a dead workqueue. KASAN has caught this as a slab-use-after-free in __queue_work() with the call chain: KASAN slab-use-after-free in __queue_work+0x56/0xa90 Read of size 4 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 __queue_work+0x56/0xa90 srso_alias_return_thunk+0x5/0xfbef5 __virt_addr_valid+0x19f/0x330 kasan_report+0xe0/0x110 __queue_delayed_work+0x58/0x1e0 queue_delayed_work_on+0xb4/0xc0 o2net_set_nn_state+0x467/0x840 o2net_disconnect_node+0x7b/0xe0 o2net_hb_node_down_cb+0x54/0x60 o2hb_run_event_list+0x236/0x2d0 o2hb_check_slot+0xad4/0xbc0 lock_release+0xc8/0x290 o2hb_check_slot+0x9ea/0xbc0 trace_hardirqs_on+0x18/0x130 o2hb_do_disk_heartbeat+0x646/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079) __lock_acquire+0x466/0x2260 lockdep_hardirqs_on_prepare+0xea/0x1a0 ktime_get_with_offset+0xe9/0x230 o2hb_thread+0x14e/0x770 kthread+0x1ad/0x1f0 ret_from_fork+0x3c9/0x540 __switch_to+0x2e9/0x730 ret_from_fork_asm+0x1a/0x30 Allocated
CVE-2026-90302
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-90302
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "7601db4c9d3bd9ab2482a863cb05204154d51ae8",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "fb61882e184ee5ca745806bc5b2a8483fa129bca",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "a03078a9a2a1c5e4a62f65d389c1f75f9898e21d",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "cbb4efc2f99d6a8dba09c96b10acad82da982cf9",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "8f96b78314cff0778a3466e49e5edbc1e459c95c",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "aee687a2fb36974dc37e4e0f5b03802067c6c4ec",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "073f51e39bed354452a057d38a4cc3952727c304",
"versionType": "git"
},
{
"status": "affected",
"version": "98211489d4147e41b11703e4245846d60b3acce4",
"lessThan": "3e326f3bf16506873777444608e8b715aab74a7a",
"versionType": "git"
}
],
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/heartbeat.h",
"fs/ocfs2/cluster/nodemanager.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.16"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.16",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.270",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.221",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.188",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.157",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.110",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.52",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.2.6",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/ocfs2/cluster/heartbeat.c",
"fs/ocfs2/cluster/heartbeat.h",
"fs/ocfs2/cluster/nodemanager.c",
"fs/ocfs2/cluster/tcp.c",
"fs/ocfs2/cluster/tcp.h"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-90302
Source reference:
/cveMetadata/cveId
Publisher severity
No explicit severity was provided.
- Event
- #36656 · Revision 1
- Added to Heist Feed
- Publisher date