Executive brief
A vulnerability in the Linux kernel's GFS2 file system could allow a system crash (NULL pointer dereference) during the unmounting process. This occurs when the system attempts to release log resources after certain internal structures have already been deleted. While this primarily affects system stability during shutdown or disk removal, it could be used to cause a denial-of-service condition on affected servers.
Technical details
A NULL pointer dereference exists in the GFS2 file system within the fs/gfs2/log.c component. During the unmount process, gfs2_log_release() may attempt to dereference sdp->sd_jdesc after it has already been deallocated. This is a regression or incomplete fix for a previous issue (Commit 35264909e9d1) which addressed the same NULL pointer in gfs2_log_flush() but missed the occurrence in gfs2_log_release(). An attacker with sufficient privileges to mount/unmount file systems could trigger this to cause a kernel panic (DoS). The issue has been resolved in various stable branches including 5.15.209, 6.1.175, and 6.6.141.
Affected products
- Linux Linux Kernel 5.15.200 to 5.15.209, 6.1.162 to 6.1.175, 6.6.37 to 6.6.141, 6.9.8 to 6.10
Timeline
- 2026-06-24: disclosed
- 2026-06-24: advisory
References
- https://git.kernel.org/stable/c/233a0945a4b1dbe3f38c30afb7d05b76c67f1193
- https://git.kernel.org/stable/c/2fc4c868c9060f424fd4a7cacb0aec5082aba4de
- https://git.kernel.org/stable/c/74b4dbb946060a3233604d91859a9abd3708141d
- https://git.kernel.org/stable/c/abd73229f0e886a91a16ea781ab656bd9b4d1ee8
- https://git.kernel.org/stable/c/cec55674354794eddb80b914f73a6bf9b7fc304a
- https://git.kernel.org/stable/c/d8ffae016c4a78693fe1283335d0b6833a9c1366
- https://git.kernel.org/stable/c/e15f16761594e80b15776980b27c35477655a135