CVE-2021-47254

What it actually does

Race condition in GFS2 glock LRU handling allows a use-after-free when GLF_LRU is cleared under lru_lock but cond_resched_lock permits concurrent __gfs2_glock_put to proceed without removing the glock from the list.

Why it matters to the business

Local attackers on affected Linux systems using GFS2 can trigger kernel memory corruption, leading to crashes, data corruption, or potential privilege escalation; widespread exposure in distributions increases patching urgency across servers and clusters.

How an attack unfolds

An attacker with local access crafts operations that exercise gfs2_glock_shrink_scan and gfs2_dispose_glock_lru concurrently with glock put paths, winning the race window opened by cond_resched_lock to access a freed glock structure and corrupt kernel memory.

How to fix it

Upgrade the Linux kernel to commit e93c9c99a629c61837d5a7fc2120cd2b6c70dbdd or later; apply distribution backports that incorporate the GLF_LRU flag fix across the cond_resched_lock window.

How to confirm the fix worked

Confirm kernel version contains the referenced commit; inspect gfs2_glock.c for the updated GLF_LRU clearing logic after list_del under lru_lock; run targeted stress tests exercising gfs2 glock LRU paths.

Typical attack path

1. Obtain local shell on target Linux system with GFS2 mounted
2. Trigger repeated glock allocation and LRU pressure while forcing scheduler rescheduling
3. Win race between shrink scan and glock put to dereference freed object
4. Leverage resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for GFS2 glock-related oops or slab corruption around gfs2_glock_shrink_scan and gfs2_dispose_glock_lru; correlate with processes performing heavy GFS2 metadata operations.

What your security team should do

• Prioritize kernel updates on all GFS2-using systems before the next scheduled maintenance window
• Monitor upstream stable branches and distribution security feeds for backported fixes
• Restrict local access on high-value GFS2 hosts until patches are deployed