An OCFS2 node that receives a malicious DLM_MIG_LOCKRES message can cause the Linux kernel to perform an out‑of‑bounds read and a heap out‑of‑bounds write (CWE‑787). The read occurs in dlm_process_recovery_data() when it iterates past the allocated buffer, and the write occurs in dlm_init_lockres() when it copies a lock name longer than the fixed 32‑byte o2dlm_lockname slab object. Both operations trigger a BUG_ON or corrupt kernel memory, leading to a panicked process and a kernel reboot, effectively destroying availability of the affected node.

The vulnerability is present in the Linux kernel itself and would affect any distribution running the vulnerable kernel version on nodes participating in an OCFS2 shared‑file‑system domain. All nodes in such a domain are potential targets, regardless of the specific vendor or distribution name.

The CVSS score of 6.6 and the EPSS score of < 1% indicate a low probability of exploitation, and the vulnerability is not listed in the CISA KEV. An attacker who can send crafted DLM_MIG_LOCKRES packets to a node within the same domain, such as a compromised cluster member or a maliciously configured client, could exploit this flaw. Successful exploitation would result in a kernel crash and denial of service on that node. The risk is mitigated by updating the kernel to a patched version that validates the message lengths before processing.