CVE-2026-53043
ocfs2/dlm: validate qr_numregions in dlm_match_regions()
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer. - Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds. This patch (of 2): The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS (32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer. Add a bounds check for qr_numregions before entering the loops.
INFO
Published Date :
June 24, 2026, 5:17 p.m.
Last Modified :
July 14, 2026, 7:27 p.m.
Remotely Exploit :
Yes !
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | CRITICAL | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Apply patch series 'ocfs2/dlm: fix two bugs in dlm_match_regions()'.
- Validate qr_numregions against O2NM_MAX_REGIONS.
- Correct off-by-one errors in comparison loops.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-53043.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-53043 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-53043
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-53043 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-53043 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Jul. 14, 2026
Action Type Old Value New Value Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.37 up to (excluding) 5.10.258 Added Reference Type kernel.org: https://git.kernel.org/stable/c/1f8b91275912cd428289c1fb424bebd7ff5302bd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/3f474c33ebc2e2ca3fcb587d7de4375348f13373 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6c6e8fc3c007319981647b410c29bb5775048551 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7ab3fbb01bc6d79091bc375e5235d360cd9b78be Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d3d5efade0c79dac1cac98c0cb1115432f804439 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f37de46149db49abd2b24f4f0c5a88cf4dfb5f47 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/f69551139caf6d24242a0ad049ee46b264e3aee0 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 28, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 24, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': 'd3d5efade0c79dac1cac98c0cb1115432f804439', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': 'f69551139caf6d24242a0ad049ee46b264e3aee0', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': '1f8b91275912cd428289c1fb424bebd7ff5302bd', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': 'f37de46149db49abd2b24f4f0c5a88cf4dfb5f47', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': '6c6e8fc3c007319981647b410c29bb5775048551', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': '3f474c33ebc2e2ca3fcb587d7de4375348f13373', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': '3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21', 'versionType': 'git'}, {'status': 'affected', 'version': 'ea2034416b54700e30371f2ad6517cbb94674083', 'lessThan': '7ab3fbb01bc6d79091bc375e5235d360cd9b78be', 'versionType': 'git'}], 'programFiles': ['fs/ocfs2/dlm/dlmdomain.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '2.6.37'}, {'status': 'unaffected', 'version': '0', 'lessThan': '2.6.37', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.258', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.209', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.175', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['fs/ocfs2/dlm/dlmdomain.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer. - Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds. This patch (of 2): The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS (32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer. Add a bounds check for qr_numregions before entering the loops. Added Reference https://git.kernel.org/stable/c/1f8b91275912cd428289c1fb424bebd7ff5302bd Added Reference https://git.kernel.org/stable/c/3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21 Added Reference https://git.kernel.org/stable/c/3f474c33ebc2e2ca3fcb587d7de4375348f13373 Added Reference https://git.kernel.org/stable/c/6c6e8fc3c007319981647b410c29bb5775048551 Added Reference https://git.kernel.org/stable/c/7ab3fbb01bc6d79091bc375e5235d360cd9b78be Added Reference https://git.kernel.org/stable/c/d3d5efade0c79dac1cac98c0cb1115432f804439 Added Reference https://git.kernel.org/stable/c/f37de46149db49abd2b24f4f0c5a88cf4dfb5f47 Added Reference https://git.kernel.org/stable/c/f69551139caf6d24242a0ad049ee46b264e3aee0