ocfs2/cluster: keep heartbeat local node stable

{
  "id": "461e61f3e14d7302f85e15e1c6b9496c34041e6dcb6a0de055073a41cb34491d",
  "url": "https://osv.dev/vulnerability/CVE-2026-90322",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "ocfs2/cluster: keep heartbeat local node stable",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: ocfs2/cluster: keep heartbeat local node stable o2nm_node_local_store() handles local=0 by stopping o2net and setting cl_local_node to O2NM_INVALID_NODE_NUM, but it leaves cl_has_local set. That stale state makes o2nm_this_node() return 255, blocks a later local=1 attempt with -EBUSY, and can feed 255 to heartbeat users that call o2nm_this_node() dynamically. Clearing cl_has_local is required when the local node is reset. But heartbeat threads can still be running at that point. They pin the local node config item at startup, yet o2hb_do_disk_heartbeat() and thread teardown re-read o2nm_this_node() for the local slot and for o2nm_undepend_this_node(). Once local=0 has cleared the live local-node state, those dynamic reads return O2NM_MAX_NODES, which is also the invalid node number 255. Store the local node number in the heartbeat region when the region starts. Use that stable node for heartbeat slot writes/checks, negotiation messages, and the final configfs undepend. Stop the heartbeat loop when the current local node no longer matches the stored node, and clear cl_has_local together with cl_local_node in the local=0 path so nodemanager state matches node removal. Validation reproduced this kernel report: KASAN slab-out-of-bounds in o2hb_do_disk_heartbeat+0x372/0xb30 RIP: 0010:memset+0xf/0x20 Read of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xd0/0x630 o2hb_do_disk_heartbeat+0x372/0xb30 (fs/o",
    "evidence": "osv:CVE-2026-90322",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "6.1.191",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.160",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-90322",
      "aliases": [
        "CVE-2026-90322"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "a7f6a5fb4bde142b622706e2006ba33f793e13ed"
                },
                {
                  "fixed": "d429482a67df16a30afaf9a3f1fe239fe73b44de"
                },
                {
                  "fixed": "d64708cc119db01fbc55017ee6e987b680ebd59c"
                },
                {
                  "fixed": "8e5cb90f212fda9f6cd29915a1ed74353108ceb3"
                },
                {
                  "fixed": "8abb2b7c60d2b2c0f40606048c873096c03874d2"
                },
                {
                  "fixed": "70d7bb7a0be033e5ebe8a2c48974692b1318891c"
                },
                {
                  "fixed": "688bc88e2046dd6ce81ce18079b5254cb8dadc0e"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90322.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "2.6.16"
                },
                {
                  "fixed": "6.1.191"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.160"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90322.json"
          }
        }
      ],
      "modified": "2026-11-01T02:30:51.112538326Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/688bc88e2046dd6ce81ce18079b5254cb8dadc0e",
        "https://git.kernel.org/stable/c/70d7bb7a0be033e5ebe8a2c48974692b1318891c",
        "https://git.kernel.org/stable/c/8abb2b7c60d2b2c0f40606048c873096c03874d2",
        "https://git.kernel.org/stable/c/8e5cb90f212fda9f6cd29915a1ed74353108ceb3",
        "https://git.kernel.org/stable/c/d429482a67df16a30afaf9a3f1fe239fe73b44de",
        "https://git.kernel.org/stable/c/d64708cc119db01fbc55017ee6e987b680ebd59c",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90322.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90322",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90322.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90322",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 492196,
  "published_at": "2026-09-17T16:08:38.768+00:00"
}