CVE-2026-53309 ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
An off-by-one error in the OCFS2 DLM region comparison allows out-of-bounds reads, potentially causing crashes or leaking memory.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-53309?
CVE-2026-53309 is a critical vulnerability in Linux kernel, published on 26 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ocfs2/dlm: fix off-by-one in dlm_match_regions() region comparison
The local-vs-remote region comparison loop uses '<=' instead of '<', causing it to read one entry past the valid range of qr_regions. The other loops in the same function correctly use '<'.
Fix the loop condition to use '<' for consistency and correctness.
Weakness: CWE-193
Which versions are affected by CVE-2026-53309?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-53309?
Apply the vendor's patch.
Is CVE-2026-53309 being exploited?
There is no known exploitation of CVE-2026-53309 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-53309, DEBIAN-CVE-2026-53309, GHSA-cjh6-575g-258g, ROOT-OS-DEBIAN-11-CVE-2026-53309, ROOT-OS-DEBIAN-12-CVE-2026-53309, ROOT-OS-UBUNTU-2204-CVE-2026-53309 and 2 more.