Executive brief
A vulnerability was identified in the Linux kernel's GFS2 file system, which is used for managing shared storage in clusters. The issue occurs during the shutdown of the file system, where certain data tracking objects are deleted from memory but remain referenced in internal lists. This can lead to a system crash or unpredictable behavior when the system attempts to access that memory later, potentially impacting the availability of the server.
Technical details
A use-after-free vulnerability exists in the GFS2 file system component of the Linux kernel due to improper management of the Least Recently Used (LRU) list. Specifically, in the qd_put() function, quota data objects were being freed synchronously during filesystem shutdown but were not removed from the LRU list. This leads to LRU list corruption and a subsequent use-after-free when the memory shrinker (gfs2_qd_shrink_scan) attempts to access these already-freed objects. An attacker with local access could potentially exploit this to cause a kernel panic or achieve local privilege escalation, though the primary impact is system instability. The issue has been resolved by ensuring objects are removed from the LRU list before being disposed of.
Affected products
- Linux Linux Kernel GFS2 file system component
Timeline
- 2025-12-14: other: Patch authored
- 2026-05-27: disclosed: CVE published