---
id: CVE-2026-89491
title: 'ocfs2: cluster: don''t sleep while holding o2hb_live_lock in o2hb_region_pin()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

  Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2.

  This series fixes three rela…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
cwe:
  - CWE-663
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    3b790774280a610f8bdbd5d4260a07345bcf8e04
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    0cbc2f20a6ea7b4a59efa9171b7c694cdd196507
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    c9be4de77f97f383b750698e1517fd296041f4bb
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    49002acc520c61002ad195894ac391c94317d3ba
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    ce035f208d68b812d83e5482980f2b1c88a9cd94
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    470212a5eefabcc16b8e2f7fe2844b8737fe571c
  - >-
    Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e <
    af09df89db9a68a1d76df0f75667998135bc8d65
  - Linux 2.6.38
published: '2026-09-11'
updated: '2026-10-19'
sourceUpdated: '2026-10-19T08:47:43.000Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-89491'
references:
  - url: 'https://git.kernel.org/stable/c/4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03'
  - url: 'https://git.kernel.org/stable/c/3b790774280a610f8bdbd5d4260a07345bcf8e04'
  - url: 'https://git.kernel.org/stable/c/0cbc2f20a6ea7b4a59efa9171b7c694cdd196507'
  - url: 'https://git.kernel.org/stable/c/c9be4de77f97f383b750698e1517fd296041f4bb'
  - url: 'https://git.kernel.org/stable/c/49002acc520c61002ad195894ac391c94317d3ba'
  - url: 'https://git.kernel.org/stable/c/ce035f208d68b812d83e5482980f2b1c88a9cd94'
  - url: 'https://git.kernel.org/stable/c/470212a5eefabcc16b8e2f7fe2844b8737fe571c'
  - url: 'https://git.kernel.org/stable/c/af09df89db9a68a1d76df0f75667998135bc8d65'
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89491.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-89491'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2532444'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-89491'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-89491'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-89491.mbox
tags:
  - cve.org
  - csaf
  - vex
  - red-hat
epss: 0.00216
epssPercentile: 0.11989
ingestedAt: '2026-09-14T15:23:07.452Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ocfs2: cluster: don't sleep while holding o2hb_live_lock in o2hb_region_pin()

Patch series "ocfs2: cluster: o2hb_region_pin() fixes", v2.

This series fixes three related issues in o2hb_region_pin(), all are from
the original implementation in commit: 58a3158a5d17 ("ocfs2/cluster:
Pin/unpin o2hb regions"):

1) It is called with o2hb_live_lock (a spinlock) held, but the
   underlying configfs_depend_item() sleeps (takes inode rwsem and
   pins the filesystem).  This triggers BUG under
   CONFIG_DEBUG_ATOMIC_SLEEP.

2) When called from the configfs drop_item callback, it creates a
   lock order inversion: parent inode_lock -> configfs root
   inode_lock, which can deadlock against subsystem unregistration
   paths taking root -> parent.

3) If pinning fails partway through o2hb_region_inc_user(), the
   o2hb_dependent_users counter is leaked and partially-pinned
   regions are never released, leaving heartbeat regions
   unprotected on subsequent mounts.

Patch 1 reworks o2hb_region_pin() to drop o2hb_live_lock across each
sleeping configfs_depend_item() call, using a config_item reference to
keep the region alive while unlocked.

Patch 2 adds a from_callback parameter to select
configfs_depend_item_unlocked() when called from configfs context,
avoiding the inode_lock nesting.

Patch 3 fixes the error path in o2hb_region_inc_user() to unpin and
decrement the counter on failure.


This patch (of 3):

o2hb_region_pin() is always called with the o2hb_live_lock spinlock held
(from o2hb_region_inc_user() and o2hb_heartbeat_group_drop_item()), but it
calls o2nm_depend_item() -> configfs_depend_item(), which sleeps: it pins
the configfs filesystem and takes the configfs root inode rwsem.  Under
CONFIG_DEBUG_ATOMIC_SLEEP this triggers:

  BUG: sleeping function called from invalid context at kernel/locking/rwsem.c
  in_atomic(): 1, ... name: mount.ocfs2
    down_write
    configfs_depend_item
    o2hb_region_pin
    o2hb_region_inc_user
    o2hb_register_callback
    dlm_register_domain_handlers
    ...
    ocfs2_dlm_init
    ocfs2_mount_volume
    ocfs2_fill_super

Rework o2hb_region_pin() to pin one region at a time with the lock dropped
across the sleeping call: under o2hb_live_lock find the next eligible
region and take a config_item reference to keep it alive, drop the lock,
call o2nm_depend_item(), then retake the lock and record the pin.  The
config_item_put() is done with the lock released as well, since
o2hb_region_release() also acquires o2hb_live_lock and can sleep.  The
region list may change while unlocked, so the scan restarts from the top
after each pin.  Local heartbeat still pins only the matching region;
global heartbeat pins all eligible regions.

The unpin path is unaffected: configfs_undepend_item() only takes a
spinlock and does not sleep.

## Affected

- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 4d64f8da82fb9e8dbd5aa9b64c9bb6ac0decea03`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 3b790774280a610f8bdbd5d4260a07345bcf8e04`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 0cbc2f20a6ea7b4a59efa9171b7c694cdd196507`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < c9be4de77f97f383b750698e1517fd296041f4bb`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 49002acc520c61002ad195894ac391c94317d3ba`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < ce035f208d68b812d83e5482980f2b1c88a9cd94`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < 470212a5eefabcc16b8e2f7fe2844b8737fe571c`
- `Linux >= 58a3158a5d17ddf4894db9e8ccaf92093ff8e42e < af09df89db9a68a1d76df0f75667998135bc8d65`
- `Linux 2.6.38`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · updated 2026-09-15 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-89491.json)