CVE-2025-40242gfs2: Fix unlikely race in gdlm_put_lock
Updated under an hour ago ()
Does this affect you?
It affects Linux. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.
- CVSS
- 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- Not given
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Deferred
- Record last updated
- Oct 15, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d1340f80f0b8066321b499a376780da00560e857 before 5fdc1474e678eea1700aa266c0b7c2c96f81dd0d; from d1340f80f0b8066321b499a376780da00560e857 before 4913592a3358f6ec366b8346b733d5e2360b08e1; from d1340f80f0b8066321b499a376780da00560e857 before 279bde3bbb0ac0bad5c729dfa85983d75a5d7641; from d1340f80f0b8066321b499a376780da00560e857 before 64c61b4ac645222fa7b724cef616c1f862a72a40; from d1340f80f0b8066321b499a376780da00560e857 before 28c4d9bc0708956c1a736a9e49fee71b65deee81; 6aa628c45875e7b8cca81ed9447a12a0e8f3504a; a97e75203733be0a4263a78fb7b29352be150c1c; 3554b46204e67333e1fb8be0e93936fb08267c80; and 13 more ranges | CNA record |
References
- https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d
- https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1
- https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641
- https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40
- https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.