Executive brief
A vulnerability was identified in the Linux kernel's GFS2 file system, which is used to manage shared storage in computer clusters. A technical error in how the system handles internal logging could lead to data corruption or system instability during heavy file operations. This issue has been resolved in recent kernel updates to ensure data is safely written to disk.
Technical details
A race condition exists in the GFS2 (Global File System 2) component of the Linux kernel. The function gfs2_logd() was found to call several log flushing functions (gfs2_ail1_start, gfs2_ail1_wait, and gfs2_ail1_empty) without properly acquiring the sd_log_flush_lock. This lack of synchronization allows concurrent transactions to interfere with the log flushing process, potentially leading to inconsistent filesystem states or kernel hangs. The fix introduces a non-locking internal flush function and ensures the appropriate write lock is held during log daemon operations. Patches have been backported to multiple stable kernel branches including 5.15.y, 6.1.y, 6.6.y, 6.12.y, and 6.18.y.
Affected products
- Linux Linux Kernel 5.7 to 6.18.33
Timeline
- 2026-03-31: other: Vulnerability fixed in upstream kernel code
- 2026-06-24: advisory: CVE-2026-53049 published
References
- https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd
- https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3
- https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921
- https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d
- https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5
- https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8
- https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8