[SRU][Q][PATCH 0/1] CVE-2026-53043

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53043

[ Impact ]

In dlm_match_regions(), the qr_numregions field from a DLM_QUERY_REGION network
message is used directly as loop bounds without validation against
O2NM_MAX_REGIONS. The o2net layer only validates message byte length, not field
values, so a crafted message can set qr_numregions up to 255 and trigger out-
of-bounds reads past the 1024-byte qr_regions buffer, which is sized for at
most 32 entries. This can be exploited remotely to leak memory or crash the
node.

[ Fix ]

questing: clean cherry-pick
focal: clean cherry-pick
bionic: clean cherry-pick
xenial: clean cherry-pick
trusty: clean cherry-pick

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A regression in the ocfs2/dlm subsystem could reject legitimate
DLM_QUERY_REGION messages or otherwise disrupt region matching during DLM node
join, potentially preventing cluster nodes from joining the domain.