{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90301 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90301 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90301 and fix it if it is affected.\n\nWhat it is: CVE-2026-90301 is a high-severity vulnerability in Linux, published on 17 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90301 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90301/ (Markdown: https://insights.sbomify.com/CVE-2026-90301/index.md)","id":"CVE-2026-90301","markdown":"https://insights.sbomify.com/CVE-2026-90301/index.md","name":"CVE-2026-90301","record":{"aliases":["AZL-102569","BELL-CVE-2026-90301","DEBIAN-CVE-2026-90301","GHSA-q5wj-37wf-cq7c","UBUNTU-CVE-2026-90301"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service"],"network_reachable":"yes","non_default_config":false,"product_category":"Linux kernel OCFS2","requires_auth":"none","summary":"A race condition in the Linux kernel OCFS2 heartbeat module allows a peer to trigger a use-after-free or crash during region setup or teardown.","user_interaction":"not_required","vuln_class":"race_condition"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: o2hb: quiesce negotiate handlers and timeout work\n\nHeartbeat regions publish struct o2hb_region as the private data for the\nNEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item()\ncreates the configfs region.  The approve handler can call\no2hb_arm_timeout(), so a peer can touch the region timeout work before\ndev_store() has finished building the heartbeat runtime, or after teardown\nhas started to shut that runtime back down.\n\nThe final configfs put also has to keep reg alive until the last in-flight\no2net callback drops its handler reference. \no2net_unregister_handler_list() blocks future handler lookups, but it does\nnot wait for sc_rx_work that already passed o2net_handler_get().  That\ndrain needs to cover local listener teardown as well, where the o2net\nordered workqueue may already be inside destroy_workqueue().\n\nFix the lifetime rule in both directions.  Initialize the region delayed\nworks before publishing reg through the o2net handler table, keep new or\nstopping regions non-armable with hr_stopping, and quiesce both delayed\nworks on failed-start and teardown paths even when no heartbeat thread is\nleft to call o2hb_disarm_timeout().  Then unregister handlers before\ntearing down handler-visible region state and make the drain wait for the\nactive or destroying o2net ordered workqueue before release frees reg.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nregion lifecycle:                late negotiate callback:\n1. make_item() registers the     1. o2net_process_message() gets a\n   region handlers before           heartbeat handler for reg.\n   dev_store() has built a       2. The callback runs after the lookup\n   runnable heartbeat context.      lock is dropped and dereferences reg.\n2. A failed start or rmdir       3. An approve or timeout path tries to\n   stops the heartbeat thread,      queue reg's delayed work, or release\n   quiesces existing work, and      races the callback body after handler\n   drops the final configfs ref.    unregister.\n3. region_release() must drain   4. The callback or delayed work can\n   handler-visible o2net rx work    outlive reg unless lifecycle code\n   before freeing reg.              keeps the region non-armable and\n                                    drains the active-or-destroying\n                                    o2net workqueue.\n\nValidation reproduced this kernel report:\nKASAN slab-use-after-free in __run_timers+0x22c/0x5b0\nWrite of size 8\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  __run_timers+0x22c/0x5b0\n  kasan_report+0xe0/0x110\n  _raw_spin_unlock_irqrestore+0x27/0x60\n  try_to_wake_up+0x191/0xf70\n  timer_expire_remote+0xae/0xf0\n  run_timer_softirq+0x19b/0x1a0\n  handle_softirqs+0x156/0x660\n  __irq_exit_rcu+0xc4/0x160\n  irq_exit_rcu+0xe/0x20\n  sysvec_apic_timer_interrupt+0x6c/0x80\n  asm_sysvec_apic_timer_interrupt+0x1a/0x20\n\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  o2hb_heartbeat_group_make_item+0x3c/0x600","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ocfs2: o2hb: quiesce negotiate handlers and timeout work","id":"CVE-2026-90301","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"race_condition","year":"2026"},"n_packages":0,"n_references":5,"next":{"headline":"ocfs2: synchronize heartbeat callbacks with o2net teardown","id":"CVE-2026-90302"},"packages":[],"prev":{"headline":"bpf: Clear buf on error in __bpf_get_task_stack","id":"CVE-2026-90300"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-21","vendors":["Linux"]},"summary":"A race condition in the Linux kernel OCFS2 heartbeat module allows a peer to trigger a use-after-free or crash during region setup or teardown.","url":"https://insights.sbomify.com/CVE-2026-90301/"}