---
title: "CVE-2026-89494: Linux Kernel ocfs2 - Out-of-Bounds Read & Write"
description: "Linux kernel ocfs2 contains an out-of-bounds read and heap out-of-bounds write caused by unvalidated num_locks and lockname_len fields in dlm_mig_lockres_handler, letting any node in the domain cause a kernel panic or memory corruption, exploit requires network access within the domain."
url: https://panop.io/threat-heartbeat/CVE-2026-89494/
---

# CVE-2026-89494 Linux Kernel ocfs2 - Out-of-Bounds Read & Write

Linux kernel ocfs2 contains an out-of-bounds read and heap out-of-bounds write caused by unvalidated num\_locks and lockname\_len fields in dlm\_mig\_lockres\_handler, letting any node in the domain cause a kernel panic or memory corruption, exploit requires network access within the domain.

CVSS base score 9.8 /10

Critical

CISA KEV

Not listed

Public exploit

None known

Authentication

Not required

EPSS

0.71% chance of exploitation in 30 days

[View the NVD record ↗](https://nvd.nist.gov/vuln/detail/CVE-2026-89494)

## Details

Type

Out-of-Bounds Read

Impact

Denial Of Service

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Published

11 September 2026

Updated

15 October 2026

## Vendor fix

Update to the latest Linux kernel version containing the fix for dlm\_mig\_lockres\_handler validation.

Patching closes this CVE. It does not tell you which of your systems run the affected version, or what else is exposed alongside them.

## References

- [https://nvd.nist.gov/vuln/detail/CVE-2026-89494](https://nvd.nist.gov/vuln/detail/CVE-2026-89494)
- [https://git.kernel.org/stable/c/b54e03d9b3697d25f4a0063cf717d459c5e3ad94](https://git.kernel.org/stable/c/b54e03d9b3697d25f4a0063cf717d459c5e3ad94)
- [https://git.kernel.org/stable/c/f33041906885f96e190cde54e61ddc69de39e3ee](https://git.kernel.org/stable/c/f33041906885f96e190cde54e61ddc69de39e3ee)
- [https://git.kernel.org/stable/c/0e999d56917f861f97adb961617b1828c9eb4733](https://git.kernel.org/stable/c/0e999d56917f861f97adb961617b1828c9eb4733)
- [https://git.kernel.org/stable/c/4a5798253212093b9ff7d90c6cfbe348bcda1594](https://git.kernel.org/stable/c/4a5798253212093b9ff7d90c6cfbe348bcda1594)
- [https://git.kernel.org/stable/c/77686fa5bba135252d348e2dacf481fc19f60c41](https://git.kernel.org/stable/c/77686fa5bba135252d348e2dacf481fc19f60c41)
- [https://git.kernel.org/stable/c/dce05b17db862f47ff60614017abe639b2e71cad](https://git.kernel.org/stable/c/dce05b17db862f47ff60614017abe639b2e71cad)
- [https://git.kernel.org/stable/c/50c4cc9183e11f83427efbf770f54851f4471c02](https://git.kernel.org/stable/c/50c4cc9183e11f83427efbf770f54851f4471c02)
- [https://git.kernel.org/stable/c/a8facb1670b4a0612183198e758d9539ef628ed9](https://git.kernel.org/stable/c/a8facb1670b4a0612183198e758d9539ef628ed9)

[← All CVEs](https://panop.io/threat-heartbeat/)

## What this record can't tell you

- Whether you run the affected software, and where
- Whether an attacker can actually reach and exploit it
- The misconfigurations that never get a CVE number
- What it would cost the business, ranked into what to fix first

Panop answers these inside your environment, for this CVE and every other finding.

[Book a demo](https://panop.io/demo)