Use-After-Free Vulnerability in Linux Kernel GFS2 by The Linux Foundation

CVE-2026-63804

What is CVE-2026-63804?

The Linux kernel's GFS2 module contains a use-after-free vulnerability that may lead to system instability and potential exploitation. When gfs2_qd_dealloc() is invoked via an RCU callback from gfs2_qd_dispose(), it accesses a superblock object after it has already been freed, which compromises memory safety. This vulnerability arises when gfs2_quota_cleanup() is executed during unmounting, where the quota objects are disposed of, and a pending RCU callback attempts to interact with freed memory. It's imperative for system administrators to address this issue promptly to protect against unauthorized access and data corruption.

References