CVE-2025-38659

What it actually does

NULL pointer dereference in gfs2_recover_func during attempted self-recovery of a GFS2 journal after node withdraw when the node is the sole mount; stems from dereferencing sd_jdesc->jd_inode after the recovery path is disabled.

Why it matters to the business

Local denial of service that can crash the kernel on systems using GFS2 clustered filesystems, leading to unplanned downtime and potential data unavailability until reboot; low public exploitability but still requires patching on affected kernels.

How an attack unfolds

An attacker with local access triggers a GFS2 withdraw on a node that is the only one mounting the filesystem, causing the recovery function to execute and hit the NULL dereference before any journal replay can occur.

How to fix it

Upgrade to a fixed kernel containing commit 1a91ba12abef628b43cada87478328274d988e88 or later; for packaged distributions apply the vendor update that removes the self-recovery logic.

How to confirm the fix worked

Confirm the running kernel contains the fix commit or the updated package version; attempt to reproduce the withdraw scenario in a test environment and verify no NULL dereference occurs.

Typical attack path

1. Obtain local shell or code execution on a system with GFS2 mounted
2. Trigger filesystem withdraw condition while the node is the sole mount
3. Force gfs2_recover_func to dereference the now-NULL jd_inode pointer
4. Kernel oops and panic resulting in denial of service

How to detect it

Search kernel logs for GFS2 withdraw messages followed immediately by NULL pointer dereference in gfs2_recover_func or sd_jdesc references; examine crash dumps for the same call path.

• gfs2_recover_func
• sdp->sd_jdesc->jd_inode
• GFS2: withdraw
• NULL pointer dereference

What your security team should do

• Prioritize kernel updates on any systems running GFS2 in production
• Review GFS2 usage and consider disabling or migrating if self-recovery behavior is relied upon
• Monitor for kernel oops logs related to gfs2_recover_func