Linux Kernel GFS2 CVE-2026-97520

Requires local access with the ability to mount a GFS2 filesystem (CAP_SYS_ADMIN or delegated user-mount rights) and the presence of a crafted or corrupted GFS2 image whose quota metadata drives gfs2_quota_init(). Exploitation is limited to systems that actually build and use the GFS2 clustered filesystem (uncommon outside HA clusters), and the UI:R metric implies a victim/operator action (mount) is needed. The commit itself is a readability refactor, so a concrete triggerable impact beyond a possible crash is not established by the available data.

This is a very low real-world priority despite the NVD CVSS 3.1 base score of 7.1 (AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H). The commit description is explicitly a cosmetic refactor of gfs2_quota_init() - moving 'qc++' from the loop body into the for-loop increment expression 'to keep iterator progression explicit' - with no stated functional or memory-safety change and no CWE assigned (N/A). There is no EPSS score, no CISA KEV listing, and no public exploit code, so no signal supports active or imminent exploitation. The signals also conflict internally: the vector claims PR:N (unauthenticated) yet the affected code path (GFS2 quota initialization) runs during filesystem mount, which realistically requires local mount privileges (CAP_SYS_ADMIN or user-mount rights), so PR:N is questionable and AC:L is likely too generous for a mount-time parsing path. The I:H/A:H impacts are not substantiated by the description of a readability change; at most this class of gfs2-image-parsing issue is crash-dominant. Net: high nominal CVSS but low practical risk - verify actual impact against the vendor commit before prioritizing.

A local user with the ability to mount a filesystem supplies a crafted or corrupted GFS2 image; when GFS2 initializes quota state (gfs2_quota_init) the iterator handling could theoretically be mishandled, leading at most to a kernel crash/denial of service. No public exploit code exists, and the change as described is a refactor rather than a demonstrated exploitable defect.