CVE-2026-53048 - Vulnerability Details

- gfs2: prevent NULL pointer dereference during unmount

Description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: prevent NULL pointer dereference during unmount

When flushing out outstanding glock work during an unmount, gfs2_log_flush()
can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc
is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in
gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it
missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.

Published: 2026-06-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A NULL pointer dereference can occur during the unmount of a GFS2 file system when the journal descriptor has already been freed. If the kernel calls gfs2_log_flush() or gfs2_log_release() at that point, the resulting crash causes a kernel panic, effectively denying service to the entire machine.

Affected Systems

This problem exists in all Linux kernel versions that ship the GFS2 file system module before the commit 35264909e9d1 was applied. Any kernel running prior to the inclusion of that commit is vulnerable. Users should verify whether their kernel contains that commit or a newer stable release.

Risk and Exploitability

The CVSS score of 5.5 and an EPSS score of less than 1% suggest a moderate severity and a low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog, indicating no known active exploits. The likely attack vector is local: an attacker must have the ability to unmount a GFS2 file system, which typically requires root or CAP_SYS_ADMIN privileges.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`c3c5cfa3170c0940bc66a142859caac07d19b9d6`	affected	< cec55674354794eddb80b914f73a6bf9b7fc304a
`5f6a84cfb33b34610623857bd93919dcb661e29b`	affected	< 2fc4c868c9060f424fd4a7cacb0aec5082aba4de
`3429ef5f50909cee9e498c50f0c499b9397116ce`	affected	< 233a0945a4b1dbe3f38c30afb7d05b76c67f1193
`35264909e9d1973ab9aaa2a1b07cda70f12bb828`	affected	< e15f16761594e80b15776980b27c35477655a135
`35264909e9d1973ab9aaa2a1b07cda70f12bb828`	affected	< d8ffae016c4a78693fe1283335d0b6833a9c1366
`35264909e9d1973ab9aaa2a1b07cda70f12bb828`	affected	< abd73229f0e886a91a16ea781ab656bd9b4d1ee8
`35264909e9d1973ab9aaa2a1b07cda70f12bb828`	affected	< 74b4dbb946060a3233604d91859a9abd3708141d
`f54f9d5368a4e92ede7dd078a62788dae3a7c6ef`	affected	—
`5.15.200`	affected	< 5.15.209
`6.1.162`	affected	< 6.1.175
`6.6.37`	affected	< 6.6.141
`6.9.8`	affected	< 6.10

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.141`	unaffected	≤ 6.6.*
`6.12.91`	unaffected	≤ 6.12.*
`6.18.33`	unaffected	≤ 6.18.*
`7.0.10`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[c3c5cfa3170c0940bc66a142859caac07d19b9d6,cec55674354794eddb80b914f73a6bf9b7fc304a)`	affected	code_commit	—
`[5f6a84cfb33b34610623857bd93919dcb661e29b,2fc4c868c9060f424fd4a7cacb0aec5082aba4de)`	affected	code_commit	—
`[3429ef5f50909cee9e498c50f0c499b9397116ce,233a0945a4b1dbe3f38c30afb7d05b76c67f1193)`	affected	code_commit	—
`[35264909e9d1973ab9aaa2a1b07cda70f12bb828,e15f16761594e80b15776980b27c35477655a135)`	affected	code_commit	—
`[35264909e9d1973ab9aaa2a1b07cda70f12bb828,d8ffae016c4a78693fe1283335d0b6833a9c1366)`	affected	code_commit	—
`[35264909e9d1973ab9aaa2a1b07cda70f12bb828,abd73229f0e886a91a16ea781ab656bd9b4d1ee8)`	affected	code_commit	—
`[35264909e9d1973ab9aaa2a1b07cda70f12bb828,74b4dbb946060a3233604d91859a9abd3708141d)`	affected	code_commit	—
`f54f9d5368a4e92ede7dd078a62788dae3a7c6ef`	affected	code_commit	—
`[5.15.200,5.15.209)`	affected	semver	—
`[6.1.162,6.1.175)`	affected	semver	—
`[6.6.37,6.6.141)`	affected	semver	—
`[6.9.8,6.10)`	affected	semver	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	semver	—
`[0,6.10)`	unaffected	generic	—
`[5.15.209,5.15.*]`	unaffected	generic	—
`[6.1.175,6.1.*]`	unaffected	generic	—
`[6.6.141,6.6.*]`	unaffected	generic	—
`[6.12.91,6.12.*]`	unaffected	generic	—
`[6.18.33,6.18.*]`	unaffected	generic	—
`[7.0.10,7.0.*]`	unaffected	generic	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade to a kernel that includes commit 35264909e9d1 or later
Limit which users can issue unmount commands on GFS2 mounts, for example by restricting CAP_SYS_ADMIN or applying SELinux/AppArmor policies
If unmounting is unavoidable, mount the GFS2 file system read‑only or otherwise avoid unmounting until a patched kernel is in place

Generated by OpenCVE AI on August 13, 2026 at 15:19 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4665-1	linux security update
Debian DLA	DLA-4671-1	linux-6.1 security update
Ubuntu USN	USN-8566-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8568-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8569-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8575-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8575-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8576-2	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8575-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8610-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8620-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8620-2	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8620-3	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8620-4	Linux kernel (Intel IoTG) vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8668-1	Linux kernel (GCP) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00162.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/233a0945a4b1dbe3f38c30afb7d05b76c67f1193
https://git.kernel.org/stable/c/2fc4c868c9060f424fd4a7cacb0aec5082aba4de
https://git.kernel.org/stable/c/74b4dbb946060a3233604d91859a9abd3708141d
https://git.kernel.org/stable/c/abd73229f0e886a91a16ea781ab656bd9b4d1ee8
https://git.kernel.org/stable/c/cec55674354794eddb80b914f73a6bf9b7fc304a
https://git.kernel.org/stable/c/d8ffae016c4a78693fe1283335d0b6833a9c1366
https://git.kernel.org/stable/c/e15f16761594e80b15776980b27c35477655a135
https://lore.kernel.org/linux-cve-announce/2026062459-CVE-2026-53048-9cd0@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-53048
https://www.cve.org/CVERecord?id=CVE-2026-53048

History

Fri, 26 Jun 2026 03:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-476

Fri, 26 Jun 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026062459-CVE-2026-53048-9cd0@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-53048 https://www.cve.org/CVERecord?id=CVE-2026-53048
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Wed, 24 Jun 2026 19:45:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476

Wed, 24 Jun 2026 17:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gfs2: prevent NULL pointer dereference during unmount When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.
Title		gfs2: prevent NULL pointer dereference during unmount
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/233a0945a4b1dbe3f38c30afb7d05b76c67f1193 https://git.kernel.org/stable/c/2fc4c868c9060f424fd4a7cacb0aec5082aba4de https://git.kernel.org/stable/c/74b4dbb946060a3233604d91859a9abd3708141d https://git.kernel.org/stable/c/abd73229f0e886a91a16ea781ab656bd9b4d1ee8 https://git.kernel.org/stable/c/cec55674354794eddb80b914f73a6bf9b7fc304a https://git.kernel.org/stable/c/d8ffae016c4a78693fe1283335d0b6833a9c1366 https://git.kernel.org/stable/c/e15f16761594e80b15776980b27c35477655a135

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-06-24T16:29:54.268Z

Updated: 2026-06-24T16:29:54.268Z

Reserved: 2026-06-09T07:44:35.381Z

Link: CVE-2026-53048

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-06-24T17:17:16.660

Modified: 2026-07-21T17:23:05.930

Link: CVE-2026-53048

Redhat

Severity : Low

Publid Date: 2026-06-24T00:00:00Z

Links: CVE-2026-53048 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T15:30:04Z

Weaknesses

CWE-476
NULL Pointer Dereference
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object