CVE-2026-90301

Estado: RecibidaAlta (8.1)—

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: o2hb: quiesce negotiate handlers and timeout work

Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down.

The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get().

Leer descripción completaMostrar menos

That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue().

Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg.

The buggy scenario involves two paths, with each column showing the order within that path:

Detalles técnicos trazas, registros y código del informe original

region lifecycle:                late negotiate callback:
1. make_item() registers the     1. o2net_process_message() gets a
   region handlers before           heartbeat handler for reg.
   dev_store() has built a       2. The callback runs after the lookup
   runnable heartbeat context.      lock is dropped and dereferences reg.
2. A failed start or rmdir       3. An approve or timeout path tries to
   stops the heartbeat thread,      queue reg's delayed work, or release
   quiesces existing work, and      races the callback body after handler
   drops the final configfs ref.    unregister.
3. region_release() must drain   4. The callback or delayed work can
   handler-visible o2net rx work    outlive reg unless lifecycle code
   before freeing reg.              keeps the region non-armable and
                                    drains the active-or-destroying
                                    o2net workqueue.

Validation reproduced this kernel report:
KASAN slab-use-after-free in __run_timers+0x22c/0x5b0
Write of size 8
Call trace:
  dump_stack_lvl+0x66/0xa0
  print_report+0xce/0x630
  __run_timers+0x22c/0x5b0
  kasan_report+0xe0/0x110
  _raw_spin_unlock_irqrestore+0x27/0x60
  try_to_wake_up+0x191/0xf70
  timer_expire_remote+0xae/0xf0
  run_timer_softirq+0x19b/0x1a0
  handle_softirqs+0x156/0x660
  __irq_exit_rcu+0xc4/0x160
  irq_exit_rcu+0xe/0x20
  sysvec_apic_timer_interrupt+0x6c/0x80
  asm_sysvec_apic_timer_interrupt+0x1a/0x20

Allocated by task stack:
  kasan_save_stack+0x33/0x60
  kasan_save_track+0x14/0x30
  __kasan_kmalloc+0xaa/0xb0
  o2hb_heartbeat_group_make_item+0x3c/0x600

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 8.1

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.45%
Percentil entre todas las CVEs puntuadas: 37
Fecha de la puntuación: 5/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access75 %
Impacto principalT1499.004 Application or System Exploitationimpact70 %
Impacto secundarioT1499 Endpoint Denial of Serviceimpact65 %

Vulnerabilidad de kernel local con CVSS alto en Linux (AV:N permite explotación remota si se combina con entrega de paquetes maliciosos). El defecto permite race condition y use-after-free que causa DoS por corrupción de memoria en manejadores de heartbeat OCFS2.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Filter Network Traffic Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Application Isolation and Sandboxing

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Linux — Linux Kernel^AI

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-90301",
  "cveTags": [],
  "metrics": {
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.1,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
              "lessThan": "b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "34069b886f95356d68bf8315fa648c4ab3193cdd",
              "lessThan": "011291b70ba4832e136b7b581825b2bc0f525bf6",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/tcp.c",
            "fs/ocfs2/cluster/tcp.h"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.7",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "fs/ocfs2/cluster/heartbeat.c",
            "fs/ocfs2/cluster/tcp.c",
            "fs/ocfs2/cluster/tcp.h"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-09-17T17:17:27.603",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/011291b70ba4832e136b7b581825b2bc0f525bf6",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b5a2907bdeced0949bcddc84b95ba7d4cb93841b",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "vulnStatus": "Received",
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: o2hb: quiesce negotiate handlers and timeout work\n\nHeartbeat regions publish struct o2hb_region as the private data for the\nNEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()\ncreates the configfs region.  The approve handler can call\no2hb_arm_timeout(), so a peer can touch the region timeout work before\ndev_store() has finished building the heartbeat runtime, or after teardown\nhas started to shut that runtime back down.\n\nThe final configfs put also has to keep reg alive until the last in-flight\no2net callback drops its handler reference. \no2net_unregister_handler_list() blocks future handler lookups, but it does\nnot wait for sc_rx_work that already passed o2net_handler_get().  That\ndrain needs to cover local listener teardown as well, where the o2net\nordered workqueue may already be inside destroy_workqueue().\n\nFix the lifetime rule in both directions.  Initialize the region delayed\nworks before publishing reg through the o2net handler table, keep new or\nstopping regions non-armable with hr_stopping, and quiesce both delayed\nworks on failed-start and teardown paths even when no heartbeat thread is\nleft to call o2hb_disarm_timeout().  Then unregister handlers before\ntearing down handler-visible region state and make the drain wait for the\nactive or destroying o2net ordered workqueue before release frees reg.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nregion lifecycle:                late negotiate callback:\n1. make_item() registers the     1. o2net_process_message() gets a\n   region handlers before           heartbeat handler for reg.\n   dev_store() has built a       2. The callback runs after the lookup\n   runnable heartbeat context.      lock is dropped and dereferences reg.\n2. A failed start or rmdir       3. An approve or timeout path tries to\n   stops the heartbeat thread,      queue reg's delayed work, or release\n   quiesces existing work, and      races the callback body after handler\n   drops the final configfs ref.    unregister.\n3. region_release() must drain   4. The callback or delayed work can\n   handler-visible o2net rx work    outlive reg unless lifecycle code\n   before freeing reg.              keeps the region non-armable and\n                                    drains the active-or-destroying\n                                    o2net workqueue.\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in __run_timers+0x22c/0x5b0\nWrite of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  __run_timers+0x22c/0x5b0\n  kasan_report+0xe0/0x110\n  _raw_spin_unlock_irqrestore+0x27/0x60\n  try_to_wake_up+0x191/0xf70\n  timer_expire_remote+0xae/0xf0\n  run_timer_softirq+0x19b/0x1a0\n  handle_softirqs+0x156/0x660\n  __irq_exit_rcu+0xc4/0x160\n  irq_exit_rcu+0xe/0x20\n  sysvec_apic_timer_interrupt+0x6c/0x80\n  asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  o2hb_heartbeat_group_make_item+0x3c/0x600"
    }
  ],
  "lastModified": "2026-09-18T18:17:52.677",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}