CVE-2026-53049

gfs2: add some missing log locking

State: Published
Severity: 9.8 Critical
Published: Jun 24, 2026
Updated: Oct 19, 2026
Reserved: Jun 9, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: add some missing log locking

Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions.

To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected Products

Product	Versions
LinuxLinux	5e4c7632aae1cce137792647f4fb6f599d1da893 to before 3b28eb75afe520972bacc833850c2b30aa0824cdAffected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before ca95342cb1b39062a03c115830286f0a426053d5Affected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before bf5fcd9c37c2546beaf7b401d31aefd89017dc3dAffected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before f2f225cf505ac016132ded21690f3ba0a080a4e8Affected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before 49d9be0722da3a4a893ba905720cba1921834ec3Affected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before 98e8bf249c790d56de1abc4a5f8bd68035a00921Affected 5e4c7632aae1cce137792647f4fb6f599d1da893 to before fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8Affected
LinuxLinux	5.7Affected before 5.7Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

5e4c7632aae1cce137792647f4fb6f599d1da893 to before 3b28eb75afe520972bacc833850c2b30aa0824cdAffected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before ca95342cb1b39062a03c115830286f0a426053d5Affected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before bf5fcd9c37c2546beaf7b401d31aefd89017dc3dAffected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before f2f225cf505ac016132ded21690f3ba0a080a4e8Affected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before 49d9be0722da3a4a893ba905720cba1921834ec3Affected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before 98e8bf249c790d56de1abc4a5f8bd68035a00921Affected
5e4c7632aae1cce137792647f4fb6f599d1da893 to before fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8Affected

LinuxLinux

5.7Affected
before 5.7Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.