Skip to main content

Linux Kernel CVE-2026-53048

| EUVDEUVD-2026-38916 MEDIUM
NULL Pointer Dereference (CWE-476)
2026-06-24 Linux GHSA-x2x3-cmvw-67w8
Denial Of Service Linux Null Pointer Dereference Red Hat Suse
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local-only vector confirmed by unmount context; PR:L because triggering requires local session; A:H for kernel panic; no C/I impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 21, 2026 - 19:46 vuln.today
CVSS changed
Jul 21, 2026 - 17:37 NVD
5.5 (MEDIUM)
Patch available
Jun 24, 2026 - 18:02 EUVD
CVE Published
Jun 24, 2026 - 16:29 nvd
MEDIUM 5.5
CVE Published
Jun 24, 2026 - 16:29 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gfs2: prevent NULL pointer dereference during unmount

When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.

AnalysisAI

NULL pointer dereference in the GFS2 filesystem's log release path crashes the Linux kernel during unmount on affected versions. The vulnerability arises because gfs2_log_release() dereferences sdp->sd_jdesc without checking for NULL, which can occur after the journal descriptor has already been freed during the unmount sequence. A prior fix (commit 35264909e9d1) addressed the same class of bug in gfs2_log_flush() but left gfs2_log_release() unprotected. No public exploit exists (EPSS 0.17%), exploitation is limited to local access on GFS2-mounted systems, and patches are available across all affected stable kernel branches.

Technical ContextAI

GFS2 (Global File System 2) is a shared-disk cluster filesystem built into the Linux kernel, designed for concurrent access from multiple cluster nodes. During unmount, the kernel flushes outstanding glock work by calling gfs2_log_flush(), which in turn can invoke gfs2_log_release(). The unmount sequence frees the journal descriptor (sdp->sd_jdesc) before this flush path completes, leaving a window where gfs2_log_release() dereferences a now-NULL pointer. The root cause class is CWE-476 (NULL Pointer Dereference): the missing NULL guard mirrors the one already added to gfs2_log_flush() by the earlier commit 35264909e9d1. Affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, spanning numerous stable branches from 5.15.x through 7.1.

RemediationAI

Upgrade to a patched kernel version on the applicable stable branch: 5.15.209, 6.1.175, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or 7.1. Upstream fix commits are available at https://git.kernel.org/stable/c/cec55674354794eddb80b914f73a6bf9b7fc304a and six additional stable-tree commits listed in the CVE references. Ubuntu users should apply the packages referenced in USN-8566-1 (https://ubuntu.com/security/notices/USN-8566-1), USN-8567-1, and USN-8568-1. As a compensating control where patching is not immediately feasible, unmounting or disabling all GFS2 filesystems eliminates the vulnerable code path entirely with no side effects on systems not dependent on cluster storage. Systems that do not use GFS2 require no action regardless of kernel version.

Same weakness CWE-476 – NULL Pointer Dereference

View all
CVE-2016-0742 HIGH
7.5
CVE-2014-3470 MEDIUM
4.3
CVE-2017-3730 HIGH POC
7.5
CVE-2017-3169 CRITICAL POC
9.8
CVE-2016-4957 HIGH
7.5
CVE-2015-3194 HIGH
7.5
CVE-2026-21525 MEDIUM
6.2
CVE-2017-0016 MEDIUM
5.9

Same technique Denial Of Service

View all
CVE-2015-5119 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2011-0611 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8
CVE-2012-0507 CRITICAL POC
9.8
CVE-2014-1761 HIGH POC
7.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2011-0609 HIGH POC
7.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-53048 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy