CVE-2026-90301 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
ocfs2: o2hb: quiesce negotiate handlers and timeout work
Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region. The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down.
The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference. o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get(). That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue().
Fix the lifetime rule in both directions. Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout(). Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg.
The buggy scenario involves two paths, with each column showing the order within that path:
region lifecycle: late negotiate callback: 1. make_item() registers the 1. o2net_process_message() gets a region handlers before heartbeat handler for reg. dev_store() has built a 2. The callback runs after the lookup runnable heartbeat context. lock is dropped and dereferences reg. 2. A failed start or rmdir 3. An approve or timeout path tries to stops the heartbeat thread, queue reg's delayed work, or release quiesces existing work, and races the callback body after handler drops the final configfs ref. unregister. 3. region_release() must drain 4. The callback or delayed work can handler-visible o2net rx work outlive reg unless lifecycle code before freeing reg. keeps the region non-armable and drains the active-or-destroying o2net workqueue.
Validation reproduced this kernel report: KASAN slab-use-after-free in __run_timers+0x22c/0x5b0 Write of size 8 Call trace: dump_stack_lvl+0x66/0xa0 print_report+0xce/0x630 __run_timers+0x22c/0x5b0 kasan_report+0xe0/0x110 _raw_spin_unlock_irqrestore+0x27/0x60 try_to_wake_up+0x191/0xf70 timer_expire_remote+0xae/0xf0 run_timer_softirq+0x19b/0x1a0 handle_softirqs+0x156/0x660 __irq_exit_rcu+0xc4/0x160 irq_exit_rcu+0xe/0x20 sysvec_apic_timer_interrupt+0x6c/0x80 asm_sysvec_apic_timer_interrupt+0x1a/0x20
Allocated by task stack: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0xaa/0xb0 o2hb_heartbeat_group_make_item+0x3c/0x600
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified in the Linux kernel's OCFS2 subsystem represents a critical use-after-free condition within the heartbeat region management logic. This flaw arises from improper synchronization between the lifecycle of configuration filesystem objects and asynchronous network handler callbacks. Specifically, when a new heartbeat region is created via make_item(), it registers its handlers for NEGO_TIMEOUT and NEGO_APPROVE events with the o2net subsystem before dev_store() has fully initialized the runtime state of that region. This premature registration allows remote peers to trigger these handlers while the local kernel context is still in an unstable or transitional state, leading to potential access of uninitialized data or use-after-free scenarios if teardown processes have already begun for related structures.
The core technical flaw involves a race condition where peer nodes can invoke o2hb_arm_timeout() through the approve handler before the heartbeat runtime is fully constructed. Furthermore, during region teardown, while o2net_unregister_handler_list successfully prevents new lookups of handlers, it fails to wait for in-flight receive work items that have already passed the initial lookup phase via o2net_handler_get(). This means that a callback can execute after the reference count has dropped and potentially freed the underlying region structure. The issue is compounded by the fact that local listener teardown may occur while the o2net ordered workqueue is still processing pending tasks, creating a window where delayed works associated with the heartbeat region are queued or executed on memory that has been released.
The operational impact of this vulnerability includes kernel panics and system instability, as evidenced by KASAN reports indicating slab-use-after-free errors in timer execution paths such as __run_timers. An attacker capable of interacting with OCFS2 cluster nodes could potentially exploit this race condition to trigger arbitrary code execution or cause a denial of service by crashing the host node through carefully timed network messages that force the system into the vulnerable state during region creation or destruction phases. The severity is heightened because it involves core clustering infrastructure, meaning multiple nodes in a cluster could be affected if one node crashes due to this flaw.
To mitigate this vulnerability, the fix implements strict lifetime rules for heartbeat regions by initializing delayed works only after they are safely published through the o2net handler table. New or stopping regions are marked as non-armable using hr_stopping flags to prevent premature activation of timeout mechanisms. Additionally, both delayed works are quiesced on failed-start and teardown paths even if no heartbeat thread remains active. The unregister process now waits for the completion of active or destroying o2net workqueues before freeing region structures, ensuring that all in-flight callbacks have completed their execution. This synchronization ensures that references to regions remain valid until all associated network handlers have finished processing.
From a classification perspective, this vulnerability aligns with CWE-416: Use After Free, as it involves accessing memory after it has been freed due to improper reference counting and lifecycle management. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, given the race condition between asynchronous network callbacks and region initialization/teardown processes. In terms of MITRE ATT&CK mapping, this could be associated with T1059: Command and Scripting Interpreter if exploited for execution, or more broadly under techniques involving exploitation of software vulnerabilities in cluster management systems to disrupt availability services.