CVE-2026-45961: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45961 Overview

CVE-2026-45961 is a memory leak vulnerability in the Linux kernel's Global File System 2 (GFS2) implementation. The flaw exists in the gfs2_fill_super() error handling path when transitioning a filesystem to read-write mode fails. Two distinct leaks occur: kernel thread objects (logd and quotad) created by init_threads() are never destroyed when gfs2_freeze_lock_shared() fails, and an 8192-byte quota bitmap allocated by gfs2_quota_init() is never freed when gfs2_make_fs_rw() fails. Upstream maintainers have resolved the issue by moving thread cleanup to the fail_per_node label and adding quota cleanup in gfs2_make_fs_rw().

Critical Impact
Repeated failed GFS2 mount attempts can exhaust kernel memory through accumulated thread structures and quota bitmap buffers, contributing to resource exhaustion on affected systems.

Affected Products

Linux kernel versions containing the GFS2 filesystem implementation prior to the fixing commits
Distributions shipping vulnerable GFS2 code in fs/gfs2/ops_fstype.c and fs/gfs2/super.c
Clustered storage environments relying on GFS2 for shared-disk filesystems

Discovery Timeline

2026-05-27 - CVE-2026-45961 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45961

Vulnerability Analysis

The vulnerability resides in the GFS2 superblock initialization routine gfs2_fill_super() in fs/gfs2/ops_fstype.c. During mount, GFS2 creates two kernel threads through init_threads(): the log daemon (logd) and the quota daemon (quotad). When subsequent initialization steps fail, the existing error-handling label fail_per_node does not invoke gfs2_destroy_threads(), leaving these task_struct and thread_struct allocations orphaned.

A second leak occurs in the quota subsystem. The function gfs2_quota_init() in fs/gfs2/quota.c allocates an 8192-byte bitmap buffer. If gfs2_make_fs_rw() in fs/gfs2/super.c subsequently fails, or the filesystem is withdrawn after successful quota initialization, this bitmap is never released.

Root Cause

The root cause is incomplete cleanup logic in the error path of gfs2_fill_super(). The fail_per_node label was not designed to unwind resources allocated by init_threads() and gfs2_quota_init(). Because these allocations occur before the existing cleanup boundaries, any failure between thread creation and successful read-write transition leaves kernel memory permanently allocated until reboot.

Attack Vector

Triggering the leak requires the ability to mount GFS2 filesystems or induce mount failures during the read-write transition. The vulnerability is a kernel memory leak [CWE-401] rather than a memory-safety corruption issue. Each failed mount attempt leaks approximately 4480 bytes for the thread structures and 8192 bytes for the quota bitmap. Repeated triggering on systems that allow user-controlled GFS2 mounts can lead to gradual kernel memory exhaustion. No code execution or privilege escalation primitive is described in the upstream commit messages.

The fix moves thread cleanup to the fail_per_node label so it executes for all error paths. gfs2_destroy_threads() is safe to call unconditionally because it checks for NULL pointers. Quota cleanup was added in gfs2_make_fs_rw() to handle the withdrawal case.

Detection Methods for CVE-2026-45961

Indicators of Compromise

Unreferenced kernel objects of size 4480 bytes traced to init_threads+0xab/0x350 in fs/gfs2/ops_fstype.c via kmemleak reports
Unreferenced kernel objects of size 8192 bytes traced to gfs2_quota_init+0xe5/0x820 in fs/gfs2/quota.c
Repeated GFS2 mount failures in dmesg correlated with growing Slab or KernelStack values in /proc/meminfo

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test kernels and inspect /sys/kernel/debug/kmemleak for the documented backtraces involving gfs2_fill_super and gfs2_make_fs_rw
Audit kernel logs for GFS2 mount errors followed by gfs2_freeze_lock_shared failures or filesystem withdrawal events
Monitor long-running hosts with GFS2 workloads for unexplained growth in kernel thread counts and slab memory

Monitoring Recommendations

Track kernel memory metrics (Slab, SReclaimable, KernelStack) over time on GFS2 cluster nodes
Alert on repeated GFS2 mount or remount-rw failures, which are the precondition for the leak
Correlate filesystem withdrawal events with subsequent memory consumption increases

How to Mitigate CVE-2026-45961

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the Kernel Git Commit da6f5bbc2e79 and Kernel Git Commit e54229ecf49a
Update to a distribution kernel that incorporates the GFS2 cleanup fixes for gfs2_fill_super() and gfs2_make_fs_rw()
Restrict the ability to mount GFS2 filesystems to trusted administrators on affected hosts

Patch Information

The fix relocates gfs2_destroy_threads() invocation to the fail_per_node label so it executes uniformly across error paths, and adds quota bitmap cleanup inside gfs2_make_fs_rw() to cover the withdrawal case. Both patches are available in the upstream stable kernel tree at the commits referenced above. Distribution maintainers backport these fixes through their standard kernel update channels.

Workarounds

Avoid repeated failed GFS2 mount cycles on production cluster nodes until the patched kernel is deployed
Reboot nodes that have accumulated leaked GFS2 thread and quota allocations to reclaim kernel memory
Disable the GFS2 module on systems that do not require clustered filesystem support by blacklisting gfs2 in /etc/modprobe.d/

bash

# Configuration example
# Verify whether the running kernel still contains the vulnerable code path
modinfo gfs2 | grep -E 'filename|version'

# Inspect kmemleak reports for the documented GFS2 backtraces
echo scan > /sys/kernel/debug/kmemleak
cat /sys/kernel/debug/kmemleak | grep -A 6 'gfs2_fill_super\|gfs2_quota_init'

# Blacklist gfs2 on hosts that do not require it
echo 'blacklist gfs2' > /etc/modprobe.d/disable-gfs2.conf