CVE-2026-74401
Description
In the Linux kernel, the following vulnerability has been resolved:
dlm: fix add msg handle in send_queue ordered
In a benchmark scenario triggering a lot of requests that triggers a lot
of DLM messages on the network it can be that the mh->seq is not ordered
according the oldest seq number. This ordering is required by
dlm_receive_ack as 'before(mh->seq, seq)' will stop to check for older
sequence numbers that are ordered in the tail of 'node->send_queue'.
The side effects of not having it correct ordered regarding
'before(mh->seq, seq)' are refcounting issues and use-after free.
I only was able to reproduce this issue in a experimental DLM branch
and a user space DLM benchmark that uses io_uring. After changing this I
don't experienced any refcounting with the sending buffer issues anymore.