CVE-2026-63804: Linux Kernel Use-After-Free Vulnerability

CVE-2026-63804 Overview

CVE-2026-63804 is a use-after-free vulnerability in the Linux kernel's Global File System 2 (gfs2) quota subsystem. The flaw resides in gfs2_qd_dealloc(), which is invoked as a Read-Copy-Update (RCU) callback from gfs2_qd_dispose(). The function accesses the superblock object sdp through qd->qd_sbd after the quota descriptor has been freed. Under certain unmount conditions, gfs2_put_super() may free the superblock via free_sbd() while RCU callbacks still hold references to it. The vulnerability has been patched upstream and backported across stable kernel branches.

Critical Impact
Local operations that trigger gfs2 unmount paths may cause kernel memory corruption or crashes due to superblock access after free.

Affected Products

Linux kernel (gfs2 filesystem subsystem)
Distributions shipping vulnerable stable kernel branches prior to the referenced fix commits
Systems mounting GFS2 filesystems with quota support enabled

Discovery Timeline

2026-07-19 - CVE-2026-63804 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-63804

Vulnerability Analysis

The vulnerability affects the quota descriptor lifecycle in the gfs2 filesystem. The gfs2_qd_dealloc() function runs as an RCU callback scheduled by gfs2_qd_dispose(). It dereferences qd->qd_sbd to decrement sd_quota_count and wake up sd_kill_wait after qd has been freed. During unmount, gfs2_quota_cleanup() disposes quota objects using call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the timeout expires, or if gfs2_gl_hash_clear() schedules additional qd_put() calls that queue more RCU callbacks after the wait completes, gfs2_put_super() proceeds to free the superblock while callbacks still reference it. This creates a use-after-free on the superblock structure sdp.

Root Cause

The root cause is a missing synchronization barrier between RCU callback completion and superblock deallocation. The unmount path assumes that a bounded wait on sd_kill_wait is sufficient, but it does not guarantee that all deferred RCU callbacks touching the superblock have executed before free_sbd() runs.

Attack Vector

The issue triggers during filesystem unmount operations on gfs2 volumes with active quota objects. An unprivileged trigger is not documented; the flaw manifests through legitimate unmount sequences where RCU callback timing races with superblock teardown. The fix adds an rcu_barrier() call before free_sbd() in gfs2_put_super() to ensure all pending RCU callbacks complete before the superblock is released.

// Prose description only - see referenced kernel commits for the exact patch
// The remediation adds rcu_barrier() in gfs2_put_super() prior to free_sbd()
// to synchronize outstanding RCU callbacks referencing the superblock.

Detection Methods for CVE-2026-63804

Indicators of Compromise

Kernel oops or panic reports referencing gfs2_qd_dealloc in the call stack during or shortly after gfs2 unmount operations
KASAN (Kernel Address Sanitizer) reports indicating use-after-free access on superblock (gfs2_sbd) memory
Unexplained kernel crashes on systems performing frequent gfs2 mount/unmount cycles with quotas enabled

Detection Strategies

Enable KASAN on test kernels to catch use-after-free accesses in the gfs2 quota path during unmount stress testing
Correlate dmesg output with unmount operations on gfs2 volumes to identify latent races
Track kernel version and patch level across the fleet to identify hosts running vulnerable gfs2 code

Monitoring Recommendations

Collect kernel crash dumps and kdump artifacts from hosts running gfs2 clusters for post-incident triage
Monitor filesystem unmount syscall telemetry on shared-storage clusters where gfs2 is deployed
Alert on repeated kernel warnings mentioning qd_put, gfs2_quota_cleanup, or sd_kill_wait

How to Mitigate CVE-2026-63804

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and update to a fixed kernel release from your distribution vendor
Reboot systems into the patched kernel after installation to ensure the vulnerable code path is replaced
Inventory hosts using gfs2 with quota support and prioritize them for patching

Patch Information

The fix adds an rcu_barrier() before free_sbd() in gfs2_put_super() so that all pending RCU callbacks, including gfs2_qd_dealloc, complete before the superblock is freed. Patches are available in the following stable commits: Kernel Patch Commit 4fe3882, Kernel Patch Commit 8745d9f, Kernel Patch Commit 9d0d5ba, Kernel Patch Commit b85ef03, and Kernel Patch Commit f9c9ec2.

Workarounds

Where patching is not immediately possible, avoid repeated mount/unmount cycles on gfs2 filesystems with quotas enabled
Consider disabling gfs2 quota functionality on non-critical volumes until the patched kernel is deployed
Restrict mount/unmount operations to trusted administrators to reduce exposure to the race window

bash

# Verify running kernel and check for gfs2 module usage
uname -r
lsmod | grep gfs2
# After installing the vendor-provided patched kernel, reboot to activate the fix
sudo reboot