GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-45961 (GCVE-0-2026-45961)

Vulnerability from cvelistv5 – Published: 2026-05-27 12:18 – Updated: 2026-05-27 12:18
VLAI
Title
gfs2: fix memory leaks in gfs2_fill_super error path
Summary
In the Linux kernel, the following vulnerability has been resolved: gfs2: fix memory leaks in gfs2_fill_super error path Fix two memory leaks in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails. First leak: kthread objects (thread_struct, task_struct, etc.) When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the created kernel threads (logd and quotad) are never destroyed. This occurs because the fail_per_node label doesn't call gfs2_destroy_threads(). Second leak: quota bitmap buffer (8192 bytes) When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but before other operations complete, the allocated quota bitmap is never freed. The fix moves thread cleanup to the fail_per_node label to handle all error paths uniformly. gfs2_destroy_threads() is safe to call unconditionally as it checks for NULL pointers. Quota cleanup is added in gfs2_make_fs_rw() to properly handle the withdrawal case where quota initialization succeeds but the filesystem is then withdrawn. Thread leak backtrace (gfs2_freeze_lock_shared failure): unreferenced object 0xffff88801d7bca80 (size 4480): copy_process+0x3a1/0x4670 kernel/fork.c:2422 kernel_clone+0xf3/0x6e0 kernel/fork.c:2779 kthread_create_on_node+0x100/0x150 kernel/kthread.c:478 init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611 gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265 Quota leak backtrace (gfs2_make_fs_rw failure): unreferenced object 0xffff88812de7c000 (size 8192): gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409 gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149 gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: b66f723bb552ad59c2acb5d45ea45c890f84498b , < e54229ecf49add8451d5f765a32c86ab4446e06c (git)
Affected: b66f723bb552ad59c2acb5d45ea45c890f84498b , < da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102 (git)
Affected: 2f8623377f3e0cfaa80558631b8694d02a492b4c (git)
Affected: c713ebf2fe3f469e4af4de60a3427689ffb7c5d7 (git)
Affected: c2191e507147b1a22e9170ebb2aaa0f2902fcbfa (git)
Affected: 9fc32dad3cdba18669c71893f3e6d96905b39b3f (git)
Affected: 5.10.173 , < 5.11 (semver)
Affected: 5.15.99 , < 5.16 (semver)
Affected: 6.1.16 , < 6.2 (semver)
Affected: 6.2.3 , < 6.3 (semver)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.19.4 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/ops_fstype.c",
            "fs/gfs2/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e54229ecf49add8451d5f765a32c86ab4446e06c",
              "status": "affected",
              "version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
              "versionType": "git"
            },
            {
              "lessThan": "da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102",
              "status": "affected",
              "version": "b66f723bb552ad59c2acb5d45ea45c890f84498b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "2f8623377f3e0cfaa80558631b8694d02a492b4c",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c713ebf2fe3f469e4af4de60a3427689ffb7c5d7",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c2191e507147b1a22e9170ebb2aaa0f2902fcbfa",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "9fc32dad3cdba18669c71893f3e6d96905b39b3f",
              "versionType": "git"
            },
            {
              "lessThan": "5.11",
              "status": "affected",
              "version": "5.10.173",
              "versionType": "semver"
            },
            {
              "lessThan": "5.16",
              "status": "affected",
              "version": "5.15.99",
              "versionType": "semver"
            },
            {
              "lessThan": "6.2",
              "status": "affected",
              "version": "6.1.16",
              "versionType": "semver"
            },
            {
              "lessThan": "6.3",
              "status": "affected",
              "version": "6.2.3",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/ops_fstype.c",
            "fs/gfs2/super.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.10.173",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "5.15.99",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.1.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "6.2.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: fix memory leaks in gfs2_fill_super error path\n\nFix two memory leaks in the gfs2_fill_super() error handling path when\ntransitioning a filesystem to read-write mode fails.\n\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\ncreated kernel threads (logd and quotad) are never destroyed. This\noccurs because the fail_per_node label doesn\u0027t call\ngfs2_destroy_threads().\n\nSecond leak: quota bitmap buffer (8192 bytes)\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\nbefore other operations complete, the allocated quota bitmap is never\nfreed.\n\nThe fix moves thread cleanup to the fail_per_node label to handle all\nerror paths uniformly. gfs2_destroy_threads() is safe to call\nunconditionally as it checks for NULL pointers. Quota cleanup is added\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\nquota initialization succeeds but the filesystem is then withdrawn.\n\nThread leak backtrace (gfs2_freeze_lock_shared failure):\n  unreferenced object 0xffff88801d7bca80 (size 4480):\n    copy_process+0x3a1/0x4670 kernel/fork.c:2422\n    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\n    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\n    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\n    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\n\nQuota leak backtrace (gfs2_make_fs_rw failure):\n  unreferenced object 0xffff88812de7c000 (size 8192):\n    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\n    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\n    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-27T12:18:17.637Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e54229ecf49add8451d5f765a32c86ab4446e06c"
        },
        {
          "url": "https://git.kernel.org/stable/c/da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102"
        }
      ],
      "title": "gfs2: fix memory leaks in gfs2_fill_super error path",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45961",
    "datePublished": "2026-05-27T12:18:17.637Z",
    "dateReserved": "2026-05-13T15:03:33.089Z",
    "dateUpdated": "2026-05-27T12:18:17.637Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-45961",
      "date": "2026-09-16",
      "epss": "0.00143",
      "percentile": "0.04014"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-10T14:55:33.000Z",
      "cve": "CVE-2026-45961",
      "id": "msrc_CVE-2026-45961",
      "initial_release_date": "2026-05-28T01:06:00.000Z",
      "product_status:known_affected": "6",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "gfs2: fix memory leaks in gfs2_fill_super error path",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-45961.json",
      "version": "7"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-45961\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-05-27T14:17:12.783\",\"lastModified\":\"2026-06-17T10:52:48.237\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ngfs2: fix memory leaks in gfs2_fill_super error path\\n\\nFix two memory leaks in the gfs2_fill_super() error handling path when\\ntransitioning a filesystem to read-write mode fails.\\n\\nFirst leak: kthread objects (thread_struct, task_struct, etc.)\\nWhen gfs2_freeze_lock_shared() fails after init_threads() succeeds, the\\ncreated kernel threads (logd and quotad) are never destroyed. This\\noccurs because the fail_per_node label doesn\u0027t call\\ngfs2_destroy_threads().\\n\\nSecond leak: quota bitmap buffer (8192 bytes)\\nWhen gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but\\nbefore other operations complete, the allocated quota bitmap is never\\nfreed.\\n\\nThe fix moves thread cleanup to the fail_per_node label to handle all\\nerror paths uniformly. gfs2_destroy_threads() is safe to call\\nunconditionally as it checks for NULL pointers. Quota cleanup is added\\nin gfs2_make_fs_rw() to properly handle the withdrawal case where\\nquota initialization succeeds but the filesystem is then withdrawn.\\n\\nThread leak backtrace (gfs2_freeze_lock_shared failure):\\n  unreferenced object 0xffff88801d7bca80 (size 4480):\\n    copy_process+0x3a1/0x4670 kernel/fork.c:2422\\n    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779\\n    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478\\n    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611\\n    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265\\n\\nQuota leak backtrace (gfs2_make_fs_rw failure):\\n  unreferenced object 0xffff88812de7c000 (size 8192):\\n    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409\\n    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149\\n    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/gfs2/ops_fstype.c\",\"fs/gfs2/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"b66f723bb552ad59c2acb5d45ea45c890f84498b\",\"lessThan\":\"e54229ecf49add8451d5f765a32c86ab4446e06c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"b66f723bb552ad59c2acb5d45ea45c890f84498b\",\"lessThan\":\"da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2f8623377f3e0cfaa80558631b8694d02a492b4c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c713ebf2fe3f469e4af4de60a3427689ffb7c5d7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c2191e507147b1a22e9170ebb2aaa0f2902fcbfa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"9fc32dad3cdba18669c71893f3e6d96905b39b3f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"5.10.173\",\"lessThan\":\"5.11\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"5.15.99\",\"lessThan\":\"5.16\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.1.16\",\"lessThan\":\"6.2\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"6.2.3\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/gfs2/ops_fstype.c\",\"fs/gfs2/super.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.4\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-401\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.10.173\",\"versionEndExcluding\":\"5.11\",\"matchCriteriaId\":\"DF6A0A9F-CF01-4C06-A4AC-AC7810053C8C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.15.99\",\"versionEndExcluding\":\"5.16\",\"matchCriteriaId\":\"55A594E3-39FC-4F69-9614-C6FC3967986F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.1.16\",\"versionEndExcluding\":\"6.2\",\"matchCriteriaId\":\"E0F792B8-000E-4D97-B7F7-B3660397A964\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2.3\",\"versionEndExcluding\":\"6.19.4\",\"matchCriteriaId\":\"A1B47306-4D45-453F-B6FB-EAA8855020F3\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/e54229ecf49add8451d5f765a32c86ab4446e06c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-28T07:40:14+00:00",
      "cve": "CVE-2026-45961",
      "id": "CVE-2026-45961",
      "initial_release_date": "2026-05-27T00:00:00+00:00",
      "product_status:known_affected": "170",
      "product_status:known_not_affected": "104",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: gfs2: fix memory leaks in gfs2_fill_super error path",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45961.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "low",
      "current_release_date": "2026-09-11T01:13:56Z",
      "cve": "CVE-2026-45961",
      "id": "CVE-2026-45961",
      "initial_release_date": "2026-05-28T03:55:23Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "528",
      "product_status:known_not_affected": "175",
      "product_status:recommended": "279",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-45961",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-45961.json",
      "version": "20"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.