CVE-2026-63804

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Jul 19, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A bug in the Linux kernel's clustered filesystem code can cause crashes or memory errors when a shared storage volume is being removed from the system.

Exploitation: Local Privilege
Attacker needs: Low Privilege
Complexity: Moderate
Impact: Full Compromise
Component: OS kernel
Class: Use After Free
Remediation: Patch
Effort: Medium
Patch risk: Low

What it actually does

Use-after-free in gfs2_qd_dealloc RCU callback that dereferences a superblock pointer after gfs2_put_super may have already called free_sbd during unmount, due to missing rcu_barrier before freeing the superblock.

Why it matters to the business

Kernel memory corruption or crash possible on systems using GFS2 filesystems during unmount operations, affecting availability and potentially allowing local privilege escalation on widely deployed Linux kernels after 99 days of public disclosure.

How an attack unfolds

An attacker with local access triggers repeated mount/unmount cycles of a GFS2 filesystem; gfs2_quota_cleanup schedules RCU callbacks for quota objects, then gfs2_put_super proceeds to free the superblock before all callbacks complete, causing the delayed gfs2_qd_dealloc to access freed memory.

How to fix it

Apply the upstream fix that adds rcu_barrier() before free_sbd() in gfs2_put_super(); rebuild and deploy a patched Linux kernel; avoid unmounting GFS2 volumes under heavy quota load until updated.

How to confirm the fix worked

Confirm kernel source contains the rcu_barrier call in gfs2_put_super before free_sbd; test by performing repeated GFS2 mount/unmount cycles with quota enabled and verify absence of use-after-free warnings or crashes.

Typical attack path

Obtain local user access on a system with GFS2 filesystem support
Create and mount a GFS2 filesystem
Trigger quota operations that allocate qd objects
Unmount the filesystem to invoke gfs2_quota_cleanup and gfs2_put_super
Race the RCU callback execution against superblock free to trigger use-after-free

How to detect it

Inspect kernel logs and dmesg for GFS2 unmount sequences followed by use-after-free or RCU-related warnings referencing gfs2_qd_dealloc or sd_quota_count; correlate with audit logs showing mount/umount activity on GFS2.

gfs2_qd_dealloc
sd_quota_count
gfs2_put_super
free_sbd
gfs2_quota_cleanup

What your security team should do

Prioritize kernel upgrade or backport of the RCU barrier fix on all GFS2-using systems
Restrict local unmount privileges for GFS2 filesystems until patched
Monitor for kernel oops or slab-use-after-free reports involving gfs2_qd_dealloc
Test patched kernels in staging environments before broad deployment

The record

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending. Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.

Affected packages

Ecosystem	Package	Introduced	Fixed