CVE-2026-89491 - Vulnerability Details

- ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Description

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2.

This series fixes three related issues in o2hb_region_pin(), all are from
the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster:
Pin/unpin o2hb regions"):

1) It is called with o2hb_live_lock (a spinlock) held, but the
underlying configfs_depend_item() sleeps (takes inode rwsem and
pins the filesystem). This triggers BUG under
CONFIG_DEBUG_ATOMIC_SLEEP.

2) When called from the configfs drop_item callback, it creates a
lock order inversion: parent inode_lock -> configfs root
inode_lock, which can deadlock against subsystem unregistration
paths taking root -> parent.

3) If pinning fails partway through o2hb_region_inc_user(), the
o2hb_dependent_users counter is leaked and partially-pinned
regions are never released, leaving heartbeat regions
unprotected on subsequent mounts.

Patch 1 reworks o2hb_region_pin() to drop o2hb_live_lock across each
sleeping configfs_depend_item() call, using a config_item reference to
keep the region alive while unlocked.

Patch 2 adds a from_callback parameter to select
configfs_depend_item_unlocked() when called from configfs context,
avoiding the inode_lock nesting.

Patch 3 fixes the error path in o2hb_region_inc_user() to unpin and
decrement the counter on failure.

This patch (of 3):

o2hb_region_pin() is always called with the o2hb_live_lock spinlock held
(from o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item()), but it
calls o2nm_depend_item() -> configfs_depend_item(), which sleeps: it pins
the configfs filesystem and takes the configfs root inode rwsem. Under
CONFIG_DEBUG_ATOMIC_SLEEP this triggers:

BUG: sleeping function called from invalid context at kernel/locking/rwsem.c
in_atomic(): 1, ... name: mount.ocfs2
down_write
configfs_depend_item
o2hb_region_pin
o2hb_region_inc_user
o2hb_register_callback
dlm_register_domain_handlers
...
ocfs2_dlm_init
ocfs2_mount_volume
ocfs2_fill_super

Rework o2hb_region_pin() to pin one region at a time with the lock dropped
across the sleeping call: under o2hb_live_lock find the next eligible
region and take a config_item reference to keep it alive, drop the lock,
call o2nm_depend_item(), then retake the lock and record the pin. The
config_item_put() is done with the lock released as well, since
o2hb_region_release() also acquires o2hb_live_lock and can sleep. The
region list may change while unlocked, so the scan restarts from the top
after each pin. Local heartbeat still pins only the matching region;
global heartbeat pins all eligible regions.

The unpin path is unaffected: configfs_undepend_item() only takes a
spinlock and does not sleep.

Published: 2026-09-11

Score: 4.4 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability originates in the OCFS2 cluster filesystem, where the o2hb_region_pin() function is invoked while holding the spinlock o2hb_live_lock. Inside this function a call to configfs_depend_item() can sleep, violating the non-preemptive lock-holding contract and triggering a BUG under CONFIG_DEBUG_ATOMIC_SLEEP. Additionally, when called from the configfs drop_item callback, the code establishes a lock‑order inversion that can deadlock kernel unregistration paths. Finally, a failure during pinning leaks a counter and leaves heartbeat regions permanently pinned, compromising the integrity of subsequent mounts. These issues together can interrupt kernel operation, freeze the system or de‑protect critical namespace data.

Affected Systems

Any Linux kernel that includes the OCFS2 cluster filesystem is impacted, as the flaw resides in the o2hb_region_pin implementation. The patch series applies to all builds that contain the original code path, and no specific version information was provided in the CVE data. Therefore, affected builds are unspecified beyond the presence of the OCFS2 cluster filesystem.

Risk and Exploitability

The CVSS score of 4.4 categorises the flaw as a low severity issue, < 1%, while the vulnerability is not listed in the CISA KEV catalog, indicating low current exploitation pressure. Attackability is largely local: who can trigger the problematic code path must have the ability to mount an OCFS2 filesystem, modify its configuration via configfs, or load the module in an unpatched kernel. The resultant denial of service is achieved by a kernel BUG or deadlock rather than by privilege escalation or data exfiltration.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< 4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< 3b790774280a610f8bdbd5d4260a07345bcf8e04
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< 0cbc2f20a6ea7b4a59efa9171b7c694cdd196507
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< c9be4de77f97f383b750698e1517fd296041f4bb
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< 49002acc520c61002ad195894ac391c94317d3ba
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< ce035f208d68b812d83e5482980f2b1c88a9cd94
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< 470212a5eefabcc16b8e2f7fe2844b8737fe571c
`58a3158a5d17ddf4894db9e8ccaf92093ff8e42e`	affected	< af09df89db9a68a1d76df0f75667998135bc8d65

Linux

affected

Version	Status	Constraints
`2.6.38`	affected	—
`0`	unaffected	< 2.6.38
`5.10.270`	unaffected	≤ 5.10.*
`5.15.221`	unaffected	≤ 5.15.*
`6.1.188`	unaffected	≤ 6.1.*
`6.6.157`	unaffected	≤ 6.6.*
`6.12.109`	unaffected	≤ 6.12.*
`6.18.50`	unaffected	≤ 6.18.*
`7.2.4`	unaffected	≤ 7.2.*
`7.3-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[58a3158a5d17ddf4894db9e8ccaf92093ff8e42e,49002acc520c61002ad195894ac391c94317d3ba)`	affected	code_commit	—
`[58a3158a5d17ddf4894db9e8ccaf92093ff8e42e,ce035f208d68b812d83e5482980f2b1c88a9cd94)`	affected	code_commit	—
`[58a3158a5d17ddf4894db9e8ccaf92093ff8e42e,470212a5eefabcc16b8e2f7fe2844b8737fe571c)`	affected	code_commit	—
`[58a3158a5d17ddf4894db9e8ccaf92093ff8e42e,af09df89db9a68a1d76df0f75667998135bc8d65)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.38`	affected	semver	—
`[0,2.6.38)`	unaffected	semver	—
`[6.12.109,6.13.0)`	unaffected	semver	—
`[6.18.50,6.19.0)`	unaffected	semver	—
`[7.2.4,7.3.0)`	unaffected	semver	—
`[7.3-rc1,*)`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the official patch series ocfs2: cluster: o2hb_region_pin() fixes, v2 to the kernel
Upgrade to a Linux kernel release that incorporates the patch
Avoid loading the OCFS2 cluster module until the kernel has been updated

Generated by OpenCVE AI on September 15, 2026 at 22:40 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DSA	DSA-6528-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0cbc2f20a6ea7b4a59efa9171b7c694cdd196507
https://git.kernel.org/stable/c/3b790774280a610f8bdbd5d4260a07345bcf8e04
https://git.kernel.org/stable/c/470212a5eefabcc16b8e2f7fe2844b8737fe571c
https://git.kernel.org/stable/c/49002acc520c61002ad195894ac391c94317d3ba
https://git.kernel.org/stable/c/4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03
https://git.kernel.org/stable/c/af09df89db9a68a1d76df0f75667998135bc8d65
https://git.kernel.org/stable/c/c9be4de77f97f383b750698e1517fd296041f4bb
https://git.kernel.org/stable/c/ce035f208d68b812d83e5482980f2b1c88a9cd94
https://nvd.nist.gov/vuln/detail/CVE-2026-89491
https://www.cve.org/CVERecord?id=CVE-2026-89491

History

Mon, 14 Sep 2026 12:30:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/0cbc2f20a6ea7b4a59efa9171b7c694cdd196507 https://git.kernel.org/stable/c/3b790774280a610f8bdbd5d4260a07345bcf8e04 https://git.kernel.org/stable/c/4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03 https://git.kernel.org/stable/c/c9be4de77f97f383b750698e1517fd296041f4bb

Sat, 12 Sep 2026 14:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-401 CWE-667

Sat, 12 Sep 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-663
References		https://nvd.nist.gov/vuln/detail/CVE-2026-89491 https://www.cve.org/CVERecord?id=CVE-2026-89491
Metrics	threat_severity `None`	cvssV3_1 `{'score': 4.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sat, 12 Sep 2026 10:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-401 CWE-667

Fri, 11 Sep 2026 23:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin() Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2. This series fixes three related issues in o2hb_region_pin(), all are from the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster: Pin/unpin o2hb regions"): 1) It is called with o2hb_live_lock (a spinlock) held, but the underlying configfs_depend_item() sleeps (takes inode rwsem and pins the filesystem). This triggers BUG under CONFIG_DEBUG_ATOMIC_SLEEP. 2) When called from the configfs drop_item callback, it creates a lock order inversion: parent inode_lock -> configfs root inode_lock, which can deadlock against subsystem unregistration paths taking root -> parent. 3) If pinning fails partway through o2hb_region_inc_user(), the o2hb_dependent_users counter is leaked and partially-pinned regions are never released, leaving heartbeat regions unprotected on subsequent mounts. Patch 1 reworks o2hb_region_pin() to drop o2hb_live_lock across each sleeping configfs_depend_item() call, using a config_item reference to keep the region alive while unlocked. Patch 2 adds a from_callback parameter to select configfs_depend_item_unlocked() when called from configfs context, avoiding the inode_lock nesting. Patch 3 fixes the error path in o2hb_region_inc_user() to unpin and decrement the counter on failure. This patch (of 3): o2hb_region_pin() is always called with the o2hb_live_lock spinlock held (from o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item()), but it calls o2nm_depend_item() -> configfs_depend_item(), which sleeps: it pins the configfs filesystem and takes the configfs root inode rwsem. Under CONFIG_DEBUG_ATOMIC_SLEEP this triggers: BUG: sleeping function called from invalid context at kernel/locking/rwsem.c in_atomic(): 1, ... name: mount.ocfs2 down_write configfs_depend_item o2hb_region_pin o2hb_region_inc_user o2hb_register_callback dlm_register_domain_handlers ... ocfs2_dlm_init ocfs2_mount_volume ocfs2_fill_super Rework o2hb_region_pin() to pin one region at a time with the lock dropped across the sleeping call: under o2hb_live_lock find the next eligible region and take a config_item reference to keep it alive, drop the lock, call o2nm_depend_item(), then retake the lock and record the pin. The config_item_put() is done with the lock released as well, since o2hb_region_release() also acquires o2hb_live_lock and can sleep. The region list may change while unlocked, so the scan restarts from the top after each pin. Local heartbeat still pins only the matching region; global heartbeat pins all eligible regions. The unpin path is unaffected: configfs_undepend_item() only takes a spinlock and does not sleep.
Title		ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/470212a5eefabcc16b8e2f7fe2844b8737fe571c https://git.kernel.org/stable/c/49002acc520c61002ad195894ac391c94317d3ba https://git.kernel.org/stable/c/af09df89db9a68a1d76df0f75667998135bc8d65 https://git.kernel.org/stable/c/ce035f208d68b812d83e5482980f2b1c88a9cd94

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-09-11T19:43:43.466Z

Updated: 2026-09-14T12:00:26.760Z

Reserved: 2026-09-11T19:38:34.713Z

Link: CVE-2026-89491

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-09-11T20:19:30.943

Modified: 2026-09-14T13:19:06.090

Link: CVE-2026-89491

Redhat

Severity : Moderate

Publid Date: 2026-09-11T19:43:43Z

Links: CVE-2026-89491 - Bugzilla

OpenCVE Enrichment

Updated: 2026-09-15T22:45:07Z

Weaknesses

CWE-663
Use of a Non-reentrant Function in a Concurrent Context

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object