In the Linux kernel a race condition was discovered in the gfs2 filesystem where the function gdlm_put_lock() could free a glock object while the lockspace was still active. The race window occurs between setting the DFL_UNMOUNT flag and releasing the lockspace, during which dlm may still invoke gdlm_ast() or gdlm_bast(). When this happens the code may dereference a freed glock, potentially leading to a crash or, if exploited, arbitrary code execution. This reflects a classic use-after-free vulnerability (CWE‑416).

The vulnerability affects Linux systems running the Linux kernel. No specific version ranges were provided, so any kernel that contains the unpatched gfs2 code may be vulnerable. The affected product is the Linux kernel itself.

The CVSS score is 7.0, indicating medium severity. The EPSS score is less than 1 %, suggesting exploitation probability is very low at this time. The issue is not listed in CISA’s KEV catalogue. Based on the description, the likely attack vector requires local privileged access that can trigger a race, such as unmounting a GFS2 filesystem while the kernel is still holding the lockspace. An attacker who can achieve this race would immediately compromise system integrity and could obtain arbitrary code execution.