Skip to main content

Linux Kernel CVE-2026-63804

| EUVDEUVD-2026-45470 HIGH
Use After Free (CWE-416)
2026-07-19 Linux GHSA-h7c8-wrgv-c7f2
Information Disclosure Linux Use After Free Memory Corruption
7.8
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
7.0 HIGH

Local-only via GFS2 unmount (AV:L); non-deterministic race tied to a timeout window makes it AC:H; requires privileged mount/unmount so PR:L at minimum; UAF can corrupt kernel memory, so C/I/A:H.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.4 MEDIUM
AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
5.5 MEDIUM
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 29, 2026 - 22:16 vuln.today
CVSS changed
Jul 29, 2026 - 20:07 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 14:17 EUVD
CVE Published
Jul 19, 2026 - 12:02 nvd
HIGH 7.8
CVE Published
Jul 19, 2026 - 12:02 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

gfs2: fix use-after-free in gfs2_qd_dealloc

gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait.

However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() triggers additional qd_put() calls that schedule more RCU callbacks after the wait completes, gfs2_put_super() will proceed to free the superblock while RCU callbacks referencing it are still pending.

Add an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks (including gfs2_qd_dealloc) have completed before the superblock is freed.

AnalysisAI

Local privilege escalation or denial of service in the Linux kernel's GFS2 filesystem is possible via a use-after-free in gfs2_qd_dealloc(), where an RCU callback dereferences the superblock (sdp) through qd->qd_sbd after gfs2_put_super() may have already freed it via free_sbd() during unmount. The race is exploitable when GFS2 quota cleanup RCU callbacks outlive the 60-second sd_kill_wait timeout or are re-scheduled by gfs2_gl_hash_clear(). No public exploit has been identified at time of analysis, and EPSS is low (0.17%, 6th percentile), consistent with a hard-to-win kernel race rather than a mass-exploited flaw.

Technical ContextAI

The flaw is in GFS2, Red Hat's shared-disk clustered filesystem for high-availability Linux clusters. The root cause is CWE-416 (use-after-free) arising from an object-lifetime mismatch between RCU deferred reclamation and superblock teardown: gfs2_qd_dispose() frees quota descriptor objects (qd) via call_rcu(), but the callback gfs2_qd_dealloc() still reaches back into the superblock through qd->qd_sbd to decrement sd_quota_count and wake sd_kill_wait. During unmount, gfs2_quota_cleanup() waits on sd_kill_wait for at most 60 seconds; if that timeout elapses or gfs2_gl_hash_clear() queues further qd_put()/RCU callbacks after the wait, gfs2_put_super() proceeds to free_sbd() while callbacks referencing the superblock are still pending. The fix inserts an rcu_barrier() before free_sbd() so all pending RCU callbacks drain before the superblock memory is released.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 6.6.144, 6.12.95, 6.18.38, 7.1.3, or mainline 7.2-rc1 or later - obtaining the corresponding vendor-backported kernel for your distribution; the fix simply adds an rcu_barrier() before free_sbd() in gfs2_put_super() and carries no functional trade-off. Reference the fix commits at git.kernel.org (e.g., https://git.kernel.org/stable/c/f9c9ec2c319f843b70ecdf939d48b52d189bc081) and the advisory at https://nvd.nist.gov/vuln/detail/CVE-2026-63804. Where patching cannot be immediate, the practical compensating control is to avoid deploying or loading the GFS2 module on systems that do not require clustered storage (e.g., blacklist the gfs2 kernel module), since the bug is only reachable through GFS2 mount/unmount with quota activity; the side effect is loss of GFS2 support, which is acceptable on hosts that do not use shared-disk clusters. Additionally restrict mount/unmount capability (CAP_SYS_ADMIN) to trusted operators to shrink the set of principals who can trigger the unmount path.

Same weakness CWE-416 – Use After Free

View all
CVE-2019-0708 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2014-0322 HIGH POC
8.8
CVE-2012-4792 HIGH POC
8.8
CVE-2009-4324 HIGH POC
7.8
CVE-2015-0313 CRITICAL POC
9.8
CVE-2015-5122 CRITICAL POC
9.8
CVE-2013-2551 HIGH POC
8.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-63804 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy