{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-90302 in the wild and no public exploit code.","fix":"Apply the vendor's patch.","what":"CVE-2026-90302 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-90302 and fix it if it is affected.\n\nWhat it is: CVE-2026-90302 is an use after free vulnerability in Linux, published on 17 Sep 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2026-90302 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-90302/ (Markdown: https://insights.sbomify.com/CVE-2026-90302/index.md)","id":"CVE-2026-90302","markdown":"https://insights.sbomify.com/CVE-2026-90302/index.md","name":"CVE-2026-90302","record":{"aliases":["AZL-102873","BELL-CVE-2026-90302","DEBIAN-CVE-2026-90302","GHSA-jpvp-fw99-v7cq","UBUNTU-CVE-2026-90302"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["denial_of_service","code_execution"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"high_privilege","summary":"A race condition in the Linux kernel OCFS2 filesystem allows a use-after-free during heartbeat teardown, potentially leading to system crashes or code execution.","user_interaction":"not_required","vuln_class":"use_after_free"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: synchronize heartbeat callbacks with o2net teardown\n\nPatch series \"ocfs2: harden heartbeat teardown races\".\n\nThis series fixes two OCFS2 heartbeat/o2net teardown races found by\nKASAN.\n\nThis patch (of 2):\n\nHeartbeat callbacks stay registered while configfs local-node teardown\nenters o2net_stop_listening().  A node-down event can still run through\no2net_disconnect_node() and o2net_set_nn_state() while teardown is\ndestroying o2net_wq, so the later queue/flush operations can hit a dead\nworkqueue.  KASAN has caught this as a slab-use-after-free in\n__queue_work() with the call chain:\n\nKASAN slab-use-after-free in __queue_work+0x56/0xa90\nRead of size 4\nCall trace:\n  dump_stack_lvl+0x66/0xa0\n  print_report+0xce/0x630\n  __queue_work+0x56/0xa90\n  srso_alias_return_thunk+0x5/0xfbef5\n  __virt_addr_valid+0x19f/0x330\n  kasan_report+0xe0/0x110\n  __queue_delayed_work+0x58/0x1e0\n  queue_delayed_work_on+0xb4/0xc0\n  o2net_set_nn_state+0x467/0x840\n  o2net_disconnect_node+0x7b/0xe0\n  o2net_hb_node_down_cb+0x54/0x60\n  o2hb_run_event_list+0x236/0x2d0\n  o2hb_check_slot+0xad4/0xbc0\n  lock_release+0xc8/0x290\n  o2hb_check_slot+0x9ea/0xbc0\n  trace_hardirqs_on+0x18/0x130\n  o2hb_do_disk_heartbeat+0x646/0xb30 (fs/ocfs2/cluster/heartbeat.c:1079)\n  __lock_acquire+0x466/0x2260\n  lockdep_hardirqs_on_prepare+0xea/0x1a0\n  ktime_get_with_offset+0xe9/0x230\n  o2hb_thread+0x14e/0x770\n  kthread+0x1ad/0x1f0\n  ret_from_fork+0x3c9/0x540\n  __switch_to+0x2e9/0x730\n  ret_from_fork_asm+0x1a/0x30\nAllocated by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  __kasan_kmalloc+0xaa/0xb0\n  __kmalloc_noprof+0x292/0x760\n  __alloc_workqueue+0x736/0xc60\n  alloc_workqueue_noprof+0xb1/0x110\n  o2net_start_listening+0xe5/0x430\n  o2nm_node_local_store+0x184/0x310\n  configfs_write_iter+0x18a/0x210\n  vfs_write+0x469/0x810\n  ksys_write+0xd2/0x170\n  do_syscall_64+0x115/0x6a0 (arch/x86/entry/syscall_64.c:87)\n  entry_SYSCALL_64_after_hwframe+0x77/0x7f\nFreed by task stack:\n  kasan_save_stack+0x33/0x60\n  kasan_save_track+0x14/0x30\n  kasan_save_free_info+0x3b/0x60\n  __kasan_slab_free+0x5f/0x80\n  kfree+0x313/0x590\n  rcu_core+0x4f4/0x1320\n  handle_softirqs+0x156/0x660\n\nqueue_delayed_work_on\no2net_set_nn_state\no2net_disconnect_node\no2net_hb_node_down_cb\no2hb_run_event_list\n\nKeep heartbeat callbacks registered so quorum state still tracks node\nstate, but stop them from driving o2net reconnect/disconnect work once\nlocal teardown starts. Mark the transport offline before destroying\no2net_wq, wait for any in-flight heartbeat callback to finish, and delay\nbring-up replay until the new local node is published through\no2nm_this_node().\n\nThe replay also has to stay serialized with heartbeat callback delivery.\nOtherwise a live-node snapshot can be copied, a real hb_down callback\ncan install -ENOTCONN for a peer, and the stale replay can call\no2net_hb_node_up() for that same peer and queue reconnect work even\nthough heartbeat is already down.\n\nThe buggy scenario involves two paths, with each column showing the order\nwithin that path:\n\nlocal-node teardown:                 heartbeat node-down callback:\n1. configfs local-off enters         1. o2hb_run_event_list() invokes\n   o2net_stop_listening().              o2net_hb_node_down_cb().\n2. teardown heads for                2. the callback reaches\n   destroy_workqueue(o2net_wq).         o2net_disconnect_node() and\n                                        o2net_set_nn_state().\n3. teardown destroys and NULLs       3. the callback flushes or queues\n   o2net_wq.                            work through o2net_wq.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"ocfs2: synchronize heartbeat callbacks with o2net teardown","id":"CVE-2026-90302","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":"use_after_free","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"ARM: 9485/1: mm: acquire mmap write lock around show_pte() for user faults","id":"CVE-2026-90303"},"packages":[],"prev":{"headline":"ocfs2: o2hb: quiesce negotiate handlers and timeout work","id":"CVE-2026-90301"},"products":["Linux"],"published":"2026-09-17","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-19","vendors":["Linux"]},"summary":"A race condition in the Linux kernel OCFS2 filesystem allows a use-after-free during heartbeat teardown, potentially leading to system crashes or code execution.","url":"https://insights.sbomify.com/CVE-2026-90302/"}