CVE-2026-53049 (GCVE-0-2026-53049)
Vulnerability from cvelistv5
Published
2026-06-24 16:29
Modified
2026-08-05 12:32
Severity ?
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().
References
Impacted products
Vendor Product Version
Linux Linux Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
Version: 5e4c7632aae1cce137792647f4fb6f599d1da893
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "3b28eb75afe520972bacc833850c2b30aa0824cd",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "ca95342cb1b39062a03c115830286f0a426053d5",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "bf5fcd9c37c2546beaf7b401d31aefd89017dc3d",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "f2f225cf505ac016132ded21690f3ba0a080a4e8",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "49d9be0722da3a4a893ba905720cba1921834ec3",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "98e8bf249c790d56de1abc4a5f8bd68035a00921",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            },
            {
              "lessThan": "fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8",
              "status": "affected",
              "version": "5e4c7632aae1cce137792647f4fb6f599d1da893",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/log.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.7"
            },
            {
              "lessThan": "5.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.141",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.91",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.10",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.141",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.91",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.33",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.10",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "5.7",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: add some missing log locking\n\nFunction gfs2_logd() calls the log flushing functions gfs2_ail1_start(),\ngfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp-\u003esd_log_flush_lock,\nbut these functions require exclusion against concurrent transactions.\n\nTo fix that, add a non-locking __gfs2_log_flush() function.  Then, in\ngfs2_logd(), take sdp-\u003esd_log_flush_lock before calling the above mentioned log\nflushing functions and __gfs2_log_flush()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - GFS2 can back kernel NFS/ksmbd exports, and remote file create/write/unlink requests reach the GFS2 VFS paths that create transactions and wake gfs2_logd. A remote attacker therefore does not need local code execution on a reasonably deployed file server using GFS2 storage.\nAC:L - The race is driven by ordinary concurrent filesystem activity and log pressure, which an attacker can create by issuing repeated parallel writes/metadata operations. No rare hardware state or uncontrollable timing condition is required beyond normal kernel scheduling.\nPR:N - In the highest reasonable deployment, a writable NFS export or guest/share can allow anonymous or unauthenticated remote write activity to reach these paths. No kernel capability or local administrative privilege is required to trigger the vulnerable log/transaction interaction in that scenario.\nUI:N - Once the GFS2 filesystem is mounted/exported, exploitation only requires attacker-initiated filesystem operations. No separate victim action is needed during the attack.\nS:U - The affected component is the host kernel filesystem implementation, and the impact remains within that kernel/filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The missing exclusion can corrupt GFS2 log/revoke and AIL state, making stale or incorrect filesystem contents plausibly reachable after replay or recovery. Under the required uncertainty rule, filesystem journal corruption that can expose arbitrary stored data is scored as high confidentiality impact.\nI:H - The bug affects journal/log bookkeeping that protects filesystem metadata and replay ordering, so a triggered race can corrupt or roll back arbitrary filesystem state. This is high integrity impact for a shared GFS2 volume.\nA:H - The race can lead to GFS2 withdraws, hangs, assertion failures, or filesystem unavailability under log flushing pressure. That is a high availability impact for the affected kernel/filesystem instance."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:32:55.082Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d"
        },
        {
          "url": "https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8"
        },
        {
          "url": "https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3"
        },
        {
          "url": "https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921"
        },
        {
          "url": "https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8"
        }
      ],
      "title": "gfs2: add some missing log locking",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-53049",
    "datePublished": "2026-06-24T16:29:55.190Z",
    "dateReserved": "2026-06-09T07:44:35.381Z",
    "dateUpdated": "2026-08-05T12:32:55.082Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.