{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  ocfs2: o2hb: quiesce negotiate handlers and timeout work  Heartbeat regions publish struct o2hb_region as the private data for the NEGO_TIMEOUT and NEGO_APPROVE o2net handlers as soon as make_item() creates the configfs region.  The approve handler can call o2hb_arm_timeout(), so a peer can touch the region timeout work before dev_store() has finished building the heartbeat runtime, or after teardown has started to shut that runtime back down.  The final configfs put also has to keep reg alive until the last in-flight o2net callback drops its handler reference.  o2net_unregister_handler_list() blocks future handler lookups, but it does not wait for sc_rx_work that already passed o2net_handler_get().  That drain needs to cover local listener teardown as well, where the o2net ordered workqueue may already be inside destroy_workqueue().  Fix the lifetime rule in both directions.  Initialize the region delayed works before publishing reg through the o2net handler table, keep new or stopping regions non-armable with hr_stopping, and quiesce both delayed works on failed-start and teardown paths even when no heartbeat thread is left to call o2hb_disarm_timeout().  Then unregister handlers before tearing down handler-visible region state and make the drain wait for the active or destroying o2net ordered workqueue before release frees reg.  The buggy scenario involves two paths, with each column showing the order within that path:  region lifecycle:                late negotiate callback: 1. make_item() registers the     1. o2net_process_message() gets a    region handlers before           heartbeat handler for reg.    dev_store() has built a       2. The callback runs after the lookup    runnable heartbeat context.      lock is dropped and dereferences reg. 2. A failed start or rmdir       3. An approve or timeout path tries to    stops the heartbeat thread,      queue reg's delayed work, or release    quiesces existing work, and      races the callback body after handler    drops the final configfs ref.    unregister. 3. region_release() must drain   4. The callback or delayed work can    handler-visible o2net rx work    outlive reg unless lifecycle code    before freeing reg.              keeps the region non-armable and                                     drains the active-or-destroying                                     o2net workqueue.  Validation reproduced this kernel report: KASAN slab-use-after-free in __run_timers+0x22c/0x5b0 Write of size 8 Call trace:   dump_stack_lvl+0x66/0xa0   print_report+0xce/0x630   __run_timers+0x22c/0x5b0   kasan_report+0xe0/0x110   _raw_spin_unlock_irqrestore+0x27/0x60   try_to_wake_up+0x191/0xf70   timer_expire_remote+0xae/0xf0   run_timer_softirq+0x19b/0x1a0   handle_softirqs+0x156/0x660   __irq_exit_rcu+0xc4/0x160   irq_exit_rcu+0xe/0x20   sysvec_apic_timer_interrupt+0x6c/0x80   asm_sysvec_apic_timer_interrupt+0x1a/0x20  Allocated by task stack:   kasan_save_stack+0x33/0x60   kasan_save_track+0x14/0x30   __kasan_kmalloc+0xaa/0xb0   o2hb_heartbeat_group_make_item+0x3c/0x600",
  "id": "DEBIAN-CVE-2026-90301",
  "modified": "2026-09-19T22:47:43.503596887Z",
  "published": "2026-09-17T17:17:27.603Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-90301"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-90301"
  ]
}