CVE-2026-63804 - Vulnerability Details

- gfs2: fix use-after-free in gfs2_qd_dealloc

Description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: fix use-after-free in gfs2_qd_dealloc

gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(),
accesses the superblock object sdp through qd->qd_sbd after freeing qd.
It does so to decrement sd_quota_count and wake up sd_kill_wait.

However, by the time the RCU callback runs, gfs2_put_super() may have
already freed sdp via free_sbd(). This can happen when
gfs2_quota_cleanup() is called during unmount: it disposes of quota
objects via call_rcu() and then waits on sd_kill_wait with a 60-second
timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers
additional qd_put() calls that schedule more RCU callbacks after the
wait completes, gfs2_put_super() will proceed to free the superblock
while RCU callbacks referencing it are still pending.

Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure
all pending RCU callbacks (including gfs2_qd_dealloc) have completed
before the superblock is freed.

Published: 2026-07-19

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A use‑after‑free bug in the GFS2 filesystem occurs when an RCU callback accesses a freed superblock during unmount or quota cleanup. The flaw allows the kernel to read or modify memory that has been released, potentially corrupting data structures or triggering a crash. The vulnerability represents a CWE‑825 condition of incorrect handling of freed resources, and while it does not directly provide an attack vector for arbitrary code execution, it can destabilize the entire kernel environment.

Affected Systems

All Linux kernel implementations that include the GFS2 file‑system module are affected. No specific vendor or version list is provided, so any kernel build containing this module before the patch is vulnerable.

Risk and Exploitability

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1 % suggests that exploitation is unlikely at present, and the vulnerability is not listed in CISA’s KEV catalog. An attacker would need local or elevated privileges to trigger the unmount or quota cleanup that drives the bug, but this privilege requirement is inferred from the description rather than explicitly stated.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`a475c5dd16e57c570113eccba51955b5df8bb052`	affected	< 4fe388218826df8607ae41a6305df67db08a9093
`a475c5dd16e57c570113eccba51955b5df8bb052`	affected	< 8745d9f7e1682c39f0a1578895ac74205e2a6757
`a475c5dd16e57c570113eccba51955b5df8bb052`	affected	< b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0
`a475c5dd16e57c570113eccba51955b5df8bb052`	affected	< 9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0
`a475c5dd16e57c570113eccba51955b5df8bb052`	affected	< f9c9ec2c319f843b70ecdf939d48b52d189bc081

Linux

affected

Version	Status	Constraints
`6.6`	affected	—
`0`	unaffected	< 6.6
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[a475c5dd16e57c570113eccba51955b5df8bb052,4fe388218826df8607ae41a6305df67db08a9093)`	affected	code_commit	—
`[a475c5dd16e57c570113eccba51955b5df8bb052,8745d9f7e1682c39f0a1578895ac74205e2a6757)`	affected	code_commit	—
`[a475c5dd16e57c570113eccba51955b5df8bb052,b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0)`	affected	code_commit	—
`[a475c5dd16e57c570113eccba51955b5df8bb052,9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0)`	affected	code_commit	—
`[a475c5dd16e57c570113eccba51955b5df8bb052,f9c9ec2c319f843b70ecdf939d48b52d189bc081)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.6`	affected	generic	—
`[0,6.6)`	unaffected	generic	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel release that contains the GFS2 rcu_barrier fix
If an update is not yet available, avoid unmounting GFS2 filesystems or force removal of mounted GFS2 instances before shutdown to minimize the window for the callback
Continuously monitor vendor advisories for an official patch and apply it as soon as it is released

Generated by OpenCVE AI on July 30, 2026 at 22:18 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00137.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093
https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757
https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0
https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0
https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63804-8035@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-63804
https://www.cve.org/CVERecord?id=CVE-2026-63804

History

Tue, 21 Jul 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-63804-8035@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-63804 https://www.cve.org/CVERecord?id=CVE-2026-63804
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Sun, 19 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending. Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.
Title		gfs2: fix use-after-free in gfs2_qd_dealloc
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/4fe388218826df8607ae41a6305df67db08a9093 https://git.kernel.org/stable/c/8745d9f7e1682c39f0a1578895ac74205e2a6757 https://git.kernel.org/stable/c/9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0 https://git.kernel.org/stable/c/b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0 https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T12:02:09.111Z

Updated: 2026-07-19T12:02:09.111Z

Reserved: 2026-07-19T07:54:57.013Z

Link: CVE-2026-63804

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-63804 - Bugzilla

OpenCVE Enrichment

Updated: 2026-07-30T22:30:06Z

Weaknesses

CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object