CVE-2026-53049

Analyzed Analyzed - Analysis Complete

Race Condition in GFS2 Filesystem Log Handling

Publication date: 2026-06-24

Last updated on: 2026-07-21

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-06-24

Last Modified

2026-07-21

Generated

2026-08-04

AI Q&A

2026-06-24

EPSS Evaluated

2026-08-02

NVD

CVE-2026-53049

EUVD

EUVD-2026-38917

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.2 (inc) to 6.6.141 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.91 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.33 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.0.10 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.175 (exc)
linux	linux_kernel	From 5.7 (inc) to 5.15.209 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-667	The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the Linux kernel's gfs2 filesystem code. Specifically, the function gfs2_logd() calls certain log flushing functions (gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty()) without holding the required lock (sd_log_flush_lock). These log flushing functions require exclusive access to prevent concurrent transactions from interfering with each other.

The fix involved adding a non-locking function __gfs2_log_flush() and modifying gfs2_logd() to acquire the sd_log_flush_lock before calling the log flushing functions and __gfs2_log_flush(), ensuring proper synchronization.

Impact Analysis

Because the log flushing functions were called without proper locking, concurrent transactions could interfere with each other, potentially leading to data corruption or inconsistencies in the gfs2 filesystem.

This could result in system instability, data loss, or unexpected behavior when using the affected filesystem on Linux systems.

Mitigation Strategies

The vulnerability in the Linux kernel related to gfs2 log locking has been fixed by adding proper locking around the log flushing functions. To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.

Identify the current kernel version running on your system.
Obtain and apply the latest kernel update or patch that contains the fix for this vulnerability.
Reboot the system to load the updated kernel.

Hi! I’m here to help you understand CVE-2026-53049. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70