Skip to main content

Linux Kernel GFS2 CVE-2026-43262

| EUVDEUVD-2026-27659 MEDIUM
Memory Leak (CWE-401)
2026-05-06 Linux GHSA-h2mh-m9gx-72x5
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only trigger requires shell access and GFS2 mount; PR:L for filesystem user access; A:H because recursive glock deadlock permanently freezes kernel threads; no C/I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

4
Analysis Generated
Jul 24, 2026 - 00:52 vuln.today
CVSS changed
May 08, 2026 - 20:52 NVD
5.5 (MEDIUM)
Patch available
May 06, 2026 - 13:32 EUVD
CVE Published
May 06, 2026 - 11:28 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

gfs2: fiemap page fault fix

In gfs2_fiemap(), we are calling iomap_fiemap() while holding the inode glock. This can lead to recursive glock taking if the fiemap buffer is memory mapped to the same inode and accessing it triggers a page fault.

Fix by disabling page faults for iomap_fiemap() and faulting in the buffer by hand if necessary.

Fixes xfstest generic/742.

AnalysisAI

Recursive glock deadlock in the Linux kernel GFS2 cluster filesystem driver allows a locally authenticated user to cause a kernel thread hang and denial of service. In gfs2_fiemap(), the inode glock is held while calling iomap_fiemap(); if the userspace fiemap output buffer is memory-mapped to the same GFS2 inode, a page fault during buffer writes triggers a second attempt to acquire the already-held glock, producing a deadlock. No public exploit or CISA KEV listing exists; EPSS is 0.02% (7th percentile), consistent with the niche GFS2 deployment footprint and the specific trigger conditions required.

Technical ContextAI

GFS2 (Global File System 2) is a shared-disk cluster filesystem integrated into the Linux kernel, used primarily in Red Hat Enterprise Linux cluster deployments. It coordinates inode access across cluster nodes using distributed locks called glocks. The fiemap ioctl (FIEMAP) enumerates a file's physical extent mappings; gfs2_fiemap() acquires the inode glock before calling iomap_fiemap() to perform this enumeration. The defect arises when the userspace-supplied output buffer passed to fiemap is backed by a memory mapping (mmap) of the same GFS2 inode: writing fiemap results into that buffer triggers a page fault, which in turn requires the kernel to acquire the inode glock - a lock the current execution context already holds. This recursive glock acquisition produces a deadlock, freezing the kernel thread and rendering the GFS2 mount unresponsive. CWE-401 (Missing Release of Memory) is listed but is a mislabeling; the root cause is improper lock re-entrancy (closer to CWE-667: Improper Locking). The fix disables page faults during iomap_fiemap() and manually faults in the userspace buffer before proceeding, breaking the recursive lock chain. Affected CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*.

RemediationAI

Upgrade to a patched Linux kernel version: 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.16, 6.19.6, or 7.0 depending on the active stable branch. Upstream fix commits are available at https://git.kernel.org/stable/c/5d5d9ec957bfa1eb2b05861c19f5d701dd006db7 and related stable commits. Ubuntu users should apply USN-8492-1 via standard package update (https://ubuntu.com/security/notices/USN-8492-1). Red Hat and SUSE users should monitor vendor security channels for distribution-specific kernel updates. As a compensating control where patching cannot be applied immediately, restricting access to GFS2 mounts to only trusted administrative users eliminates the attack surface for this specific deadlock path, though it reduces filesystem usability in multi-tenant cluster environments. Disabling GFS2 mounts entirely eliminates exposure completely but is only viable where an alternative cluster filesystem can substitute.

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-43262 vulnerability details – vuln.today

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy