Answer in brief
CVE-2026-53043 records a Critical severity (CVSS 9.1) vulnerability in ocfs2/dlm: validate qr_numregions in dlm_match_regions(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=ea2034416b54700e30371f2ad6517cbb94674083 <d3d5efade0c79dac1cac98c0cb1115432f804439 || >=ea2034416b54700e30371f2ad6517cbb94674083 <f69551139caf6d24242a0ad049ee46b264e3aee0 || >=ea2034416b54700e30371f2ad6517cbb94674083 <1f8b91275912cd428289c1fb424bebd7ff5302bd || >=ea2034416b54700e30371f2ad6517cbb94674083 <f37de46149db49abd2b24f4f0c5a88cf4dfb5f47 || >=ea2034416b54700e30371f2ad6517cbb94674083 <6c6e8fc3c007319981647b410c29bb5775048551 || >=ea2034416b54700e30371f2ad6517cbb94674083 <3f474c33ebc2e2ca3fcb587d7de4375348f13373 || >=ea2034416b54700e30371f2ad6517cbb94674083 <3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21 || >=ea2034416b54700e30371f2ad6517cbb94674083 <7ab3fbb01bc6d79091bc375e5235d360cd9b78be | d3d5efade0c79dac1cac98c0cb1115432f804439, f69551139caf6d24242a0ad049ee46b264e3aee0, 1f8b91275912cd428289c1fb424bebd7ff5302bd, f37de46149db49abd2b24f4f0c5a88cf4dfb5f47, 6c6e8fc3c007319981647b410c29bb5775048551, 3f474c33ebc2e2ca3fcb587d7de4375348f13373, 3c2d0de23ae4be22b6c18e8f0915be74d3b5fb21, 7ab3fbb01bc6d79091bc375e5235d360cd9b78be |
| Linux/Linuxgeneric | 2.6.37 | Not reported |
Published upstream
Jun 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 24, 2026
In the Linux kernel, the following vulnerability has been resolved: ocfs2/dlm: validate qr_numregions in dlm_match_regions() Patch series "ocfs2/dlm: fix two bugs in dlm_match_regions()". In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network message is used to drive loops over the qr_regions buffer without sufficient validation. This series fixes two issues: - Patch 1 adds a bounds check to reject messages where qr_numregions exceeds O2NM_MAX_REGIONS. The o2net layer only validates message byte length; it does not constrain field values, so a crafted message can set qr_numregions up to 255 and trigger out-of-bounds reads past the 1024-byte qr_regions buffer. - Patch 2 fixes an off-by-one in the local-vs-remote comparison loop, which uses '<=' instead of '<', reading one entry past the valid range even when qr_numregions is within bounds. This patch (of 2): The qr_numregions field from a DLM_QUERY_REGION network message is used directly as loop bounds in dlm_match_regions() without checking against O2NM_MAX_REGIONS. Since qr_regions is sized for at most O2NM_MAX_REGIONS (32) entries, a crafted message with qr_numregions > 32 causes out-of-bounds reads past the qr_regions buffer. Add a bounds check for qr_numregions before entering the loops.
Quoted source text, attributed separately from HOL analysis.