CVE-2026-43125

The dlm_dump_rsb_name() function accepts a 'len' parameter without validating its value, with the parameter originating directly from network messages. When the 'len' value exceeds the DLM_RESNAME_MAXLEN constant, calling dlm_search_rsb_tree() leads to an out-of-bounds write in memory (CWE-787 — buffer overflow). The patch introduces length validation before data processing, eliminating the possibility of exceeding the permissible range.

A remote attacker, without authentication, can cause kernel memory corruption, which may result in system compromise (RCE), privilege escalation, or system crash (Denial of Service).

Apply patches available from the vendor according to references — fixes have been published in the kernel.org repository (including commits: 080e5563f878, 082083c9fbd9, 5f053a2e7209, 67288113c5e6). It is recommended to update the kernel to a version containing the aforementioned changes and to restrict DLM service exposure to untrusted networks.

Linux kernel — versions indicated in vendor references (commits available in kernel.org repository).