CVE-2026-63804

Awaiting Analysis Awaiting Analysis - Queue

Use-After-Free in GFS2 Filesystem

Publication date: 2026-07-19

Last updated on: 2026-07-29

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending. Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-07-29

Generated

2026-08-09

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-08

NVD

CVE-2026-63804

EUVD

EUVD-2026-45470

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	From 6.7 (inc) to 6.12.95 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.38 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.3 (exc)
linux	linux_kernel	From 6.6 (inc) to 6.6.144 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's GFS2 file system. The issue occurs in the gfs2_qd_dealloc function, which is called as an RCU callback. It tries to access a superblock object after that object has already been freed, leading to potential memory corruption or crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's GFS2 filesystem and does not have network-based detection methods. To detect if your system is vulnerable, check the kernel version and verify if it includes the fix for CVE-2026-63804. Use the command: uname -r to check the kernel version. If your kernel version is below the patched version, the system is vulnerable.

Impact Analysis

This vulnerability could cause system instability, crashes, or unexpected behavior in systems using the GFS2 file system. It may lead to data corruption or denial of service if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA. It is a use-after-free issue in the Linux kernel's GFS2 filesystem, which could lead to system instability or crashes but does not inherently impact data protection or privacy requirements.

Mitigation Strategies

Immediately update the Linux kernel to a version that includes the fix for CVE-2026-63804. This can typically be done via your distribution's package manager, such as 'sudo apt update && sudo apt upgrade' for Debian-based systems or 'sudo yum update' for RHEL-based systems. After updating, reboot the system to ensure the new kernel is active.

Hi! I’m here to help you understand CVE-2026-63804. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70