CVE-2026-45961: gfs2: fix memory leaks in gfs2_fill_super error path
gfs2: fix memory leaks in gfs2fillsuper error path
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.1.191 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.6.160 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.12.114 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.18.57 - Upgrade
Upgrade
linux/Kernelto a version that resolves this vulnerability.Fixed in 6.19.4 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.19.6-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.14-1 - Compensating control
Update the gfs2_fill_super error handling to call gfs2_destroy_threads() unconditionally at the fail_per_node path, and add quota cleanup in gfs2_make_fs_rw() so the quota bitmap is freed when quota initialization succeeds but filesystem transition to read-write mode fails or the filesystem is withdrawn.
Event History
Frequently Asked Questions
Which systems are exposed to the resource leaks?
Systems using GFS2 are exposed when a filesystem is transitioning to read-write mode and an error occurs in the affected initialization paths. The issue involves failures after GFS2 kernel threads or quota state have been initialized.
What resources can remain allocated when the affected error paths are triggered?
A failure of gfs2_freeze_lock_shared() after init_threads() can leave the logd and quotad kernel-thread objects allocated. A failure in gfs2_make_fs_rw() after gfs2_quota_init() can leave an 8192-byte quota bitmap buffer allocated.
What does the resolved cleanup do?
The fix invokes thread cleanup from the fail_per_node path, including paths where gfs2_freeze_lock_shared() fails. It also adds quota cleanup in gfs2_make_fs_rw() for the case where quota initialization succeeds before the filesystem is withdrawn.