Linux Kernel EUVD-2026-32245

GFS2 filesystem support must be present and active on the target system (gfs2.ko kernel module loaded and a GFS2 volume configured). The vulnerability is triggered specifically during a GFS2 filesystem transition to read-write mode via gfs2_fill_super(), requiring either: (1) the cluster lock subsystem call gfs2_freeze_lock_shared() to fail after init_threads() has already created the logd and quotad kthreads - typically involving cluster DLM communication failures - or (2) gfs2_make_fs_rw() to fail after gfs2_quota_init() completes successfully, such as during a filesystem withdrawal event. Neither error path is reachable on default or non-GFS2 Linux configurations. Per CVSS PR:L, low-privilege local authenticated access is required. Systems without the gfs2 module loaded, or systems not using GFS2 cluster filesystems, have zero exposure.

CVSS 5.5 (Medium) with vector AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H accurately reflects a local, low-complexity, low-privilege memory leak with availability-only impact. The EPSS score of 0.02% (5th percentile) indicates very low real-world exploitation probability, consistent with a niche cluster filesystem subsystem reachable only on hosts that actively use GFS2. The vulnerability is not listed in CISA KEV and no public exploit code has been identified. Real-world risk is low to moderate: the leak manifests only along specific error paths (gfs2_freeze_lock_shared failure or gfs2_make_fs_rw withdrawal), meaning exploitation requires a GFS2 mount attempt that encounters internal cluster lock or quota subsystem failures - not a default or trivially triggerable condition. Repeated triggering, such as an automated re-mount loop under error conditions, could gradually exhaust kernel memory and produce OOM events. No confidentiality or integrity impact exists, strictly bounding blast radius to availability. This vulnerability does not merit emergency patching for most organizations unless GFS2 is actively deployed in a cluster environment accessible to untrusted local users.

A local user with low-level authenticated access on a Linux host running GFS2 cluster filesystems could repeatedly induce GFS2 mount failures - for example by disrupting cluster lock manager communication or causing quota subsystem errors - each iteration leaking kernel thread objects or quota bitmap memory. Over many such cycles, accumulated leaked kernel memory could push the host toward OOM conditions, causing service disruption or a kernel OOM kill of critical processes. No public exploit code exists for this vulnerability at time of analysis.