The Linux kernel’s ocfs2 and DLM components contain an off‑by‑one error in the dlm_match_regions() routine. The local‑vs‑remote region comparison loop incorrectly uses "<=" instead of "<", which causes the code to read one entry beyond the end of the qr_regions array. This out‑of‑bounds read can expose kernel memory contents or trigger a crash, leading to either information disclosure or denial of service. The weakness is a classic memory corruption flaw involving improper bounds checking.

All Linux kernel distributions that include the ocfs2 filesystem and the Dynamic Lock Manager (DLM) are affected. The specific affected versions are not listed in the CVE data, so any kernel release containing the described components may be vulnerable unless it has been patched since the issue was discovered.

The CVSS score of 9.8 reflects critical severity, while the EPSS score is less than 1 % and the vulnerability is not in the CISA KEV catalog. The flaw requires a local or privileged attacker who can invoke dlm_match_regions(), meaning that remote exploitation is unlikely with the information given. The risk is high for systems running vulnerable ocfs2/DLM configurations, but the low exploitation probability and lack of a known remote trigger reduce the immediate threat level compared to typical remote‑attackable vulnerabilities.