In the Linux kernel, the gfs2 filesystem suffered from two memory leaks in the gfs2_fill_super error handling path. When a transition to read‑write mode fails, kernel threads and quota bitmap buffers are left allocated, potentially exhausting kernel memory and leading to system instability or denial of service.

This issue affects any Linux kernel that includes the gfs2 filesystem and has not yet incorporated the commit that moves thread cleanup to the fail_per_node label and adds quota cleanup. The exact version range is not specified, but all kernels prior to the patch are vulnerable.

The EPSS score is < 1%, indicating a very low but non‑zero probability of exploitation. It is not listed in CISA's KEV catalog. The CVSS score of 5.5 denotes medium severity, meaning an attacker can potentially deplete kernel memory and cause a denial of service if they can trigger the gfs2 filesystem mount or reboot sequence that forces a transition to read‑write mode. The vulnerability requires privileges that allow mounting or configuring GFS2 filesystems, an attack vector that likely occurs via local or application-level access that can influence kernel operations. Overall, the risk is moderate but actionable, particularly in environments that use GFS2 and lack the recent commit that moves thread cleanup to the fail_per_node label and adds quota cleanup.