{
  "cveId": "CVE-2026-99204",
  "url": "https://patchblox.com/security/cve/CVE-2026-99204",
  "summary": "CVE-2026-99204 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99204, released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "ocfs2/dlm: Protect the recovery list during debugfs reads",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2/dlm: Protect the recovery list during debugfs reads  Recovery participant records must remain alive while debug_state_print() walks reco.node_data and formats their fields. The formatter holds dlm-\u003Espinlock, but the recovery participant list is protected by dlm_reco_state_lock. In particular, dlm_destroy_recovery_area() detaches the list under dlm_reco_state_lock and frees the detached records after releasing it. A concurrent debugfs open can therefore read freed memory.  Protect the participant traversal and field reads in debug_state_print() with dlm_reco_state_lock, matching the existing list writers. This also serializes the traversal against list_add_tail() during recovery-area initialization. Make the existing lock available to the debug code through dlmcommon.h; the lock remains internal to the OCFS2 DLM module.  Release dlm-\u003Espinlock after formatting the other domain state and before acquiring dlm_reco_state_lock, so the debug reader does not nest the two locks. Leave recovery list insertion, detachment and freeing unchanged.  KASAN report as below:      BUG: KASAN: slab-use-after-free in debug_state_open\u002B0x1169/0x12d0     Read of size 4 at addr ffff88810662ef80 by task dlm-state-stres/896      CPU: 1 UID: 0 PID: 896 Comm: dlm-state-stres Not tainted 7.3.0-rc4-next-20260921-pmb-ocfs2-functional-v1\u002B #1 PREEMPT(lazy)     Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX \u002B PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014     Call Trace:      \u003CTASK\u003E      dump_stack_lvl\u002B0x93/0xd0      print_report\u002B0xce/0x630      ? debug_state_open\u002B0x1169/0x12d0      ? srso_alias_return_thunk\u002B0x5/0xfbef5      ? __virt_addr_valid\u002B0x20e/0x420      ? debug_state_open\u002B0x1169/0x12d0      kasan_report\u002B0xe0/0x110      ? debug_state_open\u002B0x1169/0x12d0      debug_state_open\u002B0x1169/0x12d0      ? __pfx_debug_state_open\u002B0x10/0x10      full_proxy_open_regular\u002B0x193/0x310      do_dentry_open\u002B0x595/0x12d0      ? __pfx_full_proxy_open_regular\u002B0x10/0x10      vfs_open_consume\u002B0xd1/0x400      ? srso_alias_return_thunk\u002B0x5/0xfbef5      path_openat\u002B0x18d0/0x2020      ? __pfx_path_openat\u002B0x10/0x10      do_file_open\u002B0x21e/0x470      ? __pfx_do_file_open\u002B0x10/0x10      ? _raw_spin_unlock\u002B0x23/0x40      ? srso_alias_return_thunk\u002B0x5/0xfbef5      ? alloc_fd\u002B0x3a6/0x6b0      do_sys_openat2\u002B0xf4/0x1b0      ? __pfx_do_sys_openat2\u002B0x10/0x10      ? srso_alias_return_thunk\u002B0x5/0xfbef5      ? __fput\u002B0x5b5/0xa60      __x64_sys_openat\u002B0x136/0x1e0      ? __pfx___x64_sys_openat\u002B0x10/0x10      do_syscall_64\u002B0x114/0x620      entry_SYSCALL_64_after_hwframe\u002B0x77/0x7f     [Register dump omitted.]      \u003C/TASK\u003E      Allocated by task 880:      kasan_save_stack\u002B0x33/0x60      kasan_save_track\u002B0x14/0x30      __kasan_kmalloc\u002B0xaa/0xb0      __kmalloc_cache_noprof\u002B0x28d/0x610      dlm_remaster_locks\u002B0x147/0x1d90      dlm_do_recovery\u002B0xde1/0x1580      dlm_recovery_thread\u002B0x109/0x300      kthread\u002B0x351/0x460      ret_from_fork\u002B0x659/0x940      ret_from_fork_asm\u002B0x1a/0x30      Freed by task 880:      kasan_save_stack\u002B0x33/0x60      kasan_save_track\u002B0x14/0x30      kasan_save_free_info\u002B0x3b/0x60      __kasan_slab_free\u002B0x5f/0x80      kfree\u002B0x308/0x580      dlm_destroy_recovery_area\u002B0x285/0x460      dlm_remaster_locks\u002B0x17c4/0x1d90      dlm_do_recovery\u002B0xde1/0x1580      dlm_recovery_thread\u002B0x109/0x300      kthread\u002B0x351/0x460      ret_from_fork\u002B0x659/0x940      ret_from_fork_asm\u002B0x1a/0x30      The buggy address belongs to the object at ffff88810662ef80      which belongs to the cache kmalloc-32 of size 32     The buggy address is located 0 bytes inside of      freed 32-byte region [ffff88810662ef80, ffff88810662efa0)      [Page and memory-state dumps omitted.]",
  "published": "2026-10-28T11:17:41Z",
  "severity": "Moderate",
  "cvss": 7.1,
  "epss": 0.00171,
  "epssPercentile": 0.06497,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99204",
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.115-2",
      "fix": "DEBIAN-CVE-2026-99204",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99204",
      "released": "2026-11-03T18:58:21Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.2.13-1",
      "fix": "DEBIAN-CVE-2026-99204",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-99204",
      "released": "2026-11-03T18:58:21Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}