The vulnerability resides in the Linux kernel’s ocfs2/dlm component, where the field qr_numregions from a DLM_QUERY_REGION network message is used directly as a loop bound without verifying it against the maximum allowed value. A crafted message can set qr_numregions to any value up to 255, which exceeds the 32‑entry buffer of qr_regions and causes the kernel to perform out‑of‑bounds reads. The off‑by‑one error in a comparison loop exacerbates the issue by reading an additional entry even when qr_numregions is within bounds. These unchecked reads can leak kernel memory contents to a remote attacker or trigger a crash, compromising confidentiality and availability.

All Linux distributions that ship the ocfs2 filesystem with the Distributed Lock Manager (dlm) component are affected, regardless of the specific kernel release. The vulnerability does not list particular kernel versions, so any installation that incorporates the ocfs2/dlm module and has not been updated with the patch series can be vulnerable.

No CVSS or EPSS score is publicly available, and the vulnerability is not currently listed in the CISA KEV catalog. The most likely attack vector is a remote attacker sending a malicious DLM_QUERY_REGION packet to a machine running the ocfs2/dlm service. Because the fault manifests as unchecked memory access, exploitation is relatively straightforward for an attacker with networking access to the service, potentially yielding information disclosure or denial of service. The severity is mitigated only by applying the code changes that enforce bounds checking.