CVE-2026-53049: Linux kernel GFS2: missing locking in log flush path
The Linux kernel GFS2 code calls log flushing routines from gfs2_logd() without holding sdp->sd_log_flush_lock, which those routines need to exclude concurrent transactions. Upstream commits add a non-locking __gfs2_log_flush() helper and make gfs2_logd() take the lock before the flush calls. The CNA scored the issue 9.8 (critical) under CVSS 3.1, and no confirmed exploitation appears in the sources consulted.
Overview
The record describes a locking gap in the GFS2 filesystem code of the Linux kernel. The function gfs2_logd() calls gfs2_ail1_start(), gfs2_ail1_wait() and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, although these functions require exclusion against concurrent transactions. The fix described in the record adds a non-locking __gfs2_log_flush() function and makes gfs2_logd() take the lock before the flush calls.
Impact
The CNA assigned a CVSS 3.1 base score of 9.8 (critical) with the vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, which indicates high confidentiality, integrity and availability impact as scored. The description does not state a concrete consequence such as a crash, data corruption or privilege escalation. The record does not explain how the unlocked path would be reached over a network without privileges, so this scoring should be checked against the CNA or NVD analysis.
Affected products and versions
The record lists the Linux Linux Kernel product with these ranges:
- From 5.7 up to but excluding 5.15.209
- From 5.16 up to but excluding 6.1.175
- From 6.2 up to but excluding 6.6.141
- From 6.7 up to but excluding 6.12.91
- From 6.13 up to but excluding 6.18.33
- From 6.19 up to but excluding 7.0.10
Seven patch commits on the kernel.org stable tree are linked in the record. The record does not map each commit to a specific branch, so administrators should confirm the fix status of their own kernel build with their distribution or vendor.
Exploitation status
The record shows the issue as not listed in the CISA KEV catalog. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Update to a stable kernel release that includes the upstream commits listed in the record, using the update channel of your distribution or vendor.
- Prioritize systems that mount GFS2 filesystems, since the flaw is in that code path.
- Review vendor advisories for backported fixes, because stable branch numbering alone may not reflect every distribution build.
Detection guidance
- Inventory kernel versions and compare them against the affected ranges above.
- Identify hosts where the gfs2 module is loaded or GFS2 volumes are mounted.
- Watch kernel logs for GFS2 errors or hangs related to log flushing as a general health signal, without treating their absence as proof of safety.
Limitations of the available information
The record provides the commit description, CVSS data from the CNA, affected ranges and patch links, but no proof of concept, no crash trace and no vendor-specific impact analysis. The CWE is listed as CWE-667 without a name in the record. The exact conditions needed to trigger a problem are not stated.
For the full record, see NVD and CVE Record.
Frequently asked questions
Is CVE-2026-53049 being exploited?
The record marks the CVE as not listed in the CISA KEV catalog, and no confirmed exploitation appears in the sources consulted.
Which Linux kernel versions are affected?
The record lists ranges from 5.7 up to but excluding 5.15.209, 5.16 up to but excluding 6.1.175, 6.2 up to but excluding 6.6.141, 6.7 up to but excluding 6.12.91, 6.13 up to but excluding 6.18.33, and 6.19 up to but excluding 7.0.10.
What should administrators do?
Update to a stable kernel from their distribution or vendor that includes the upstream commits listed in the record, and confirm the fix status of their own build.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.