CVE-2026-53049: gfs2: add some missing log locking
In the Linux kernel, the following vulnerability has been resolved:
gfs2: add some missing log locking
Function gfs2logd() calls the log flushing functions gfs2ail1start(), gfs2ail1wait(), and gfs2ail1empty() without holding sdp->sdlogflushlock, but these functions require exclusion against concurrent transactions.
To fix that, add a non-locking gfs2logflush() function. Then, in gfs2logd(), take sdp->sdlogflushlock before calling the above mentioned log flushing functions and gfs2logflush().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Add the non-locking __gfs2_log_flush() function, and have gfs2_logd() acquire sdp->sd_log_flush_lock before calling gfs2_ail1_start(), gfs2_ail1_wait(), gfs2_ail1_empty(), or __gfs2_log_flush(), ensuring exclusion against concurrent transactions.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-53049?
The severity of CVE-2026-53049 is rated as risk 27.
How do I fix CVE-2026-53049?
To fix CVE-2026-53049, you should update to the latest version of the Linux kernel that addresses this vulnerability.
What type of vulnerability is CVE-2026-53049?
CVE-2026-53049 is a locking issue related to the gfs2 file system in the Linux kernel.
Which component is affected by CVE-2026-53049?
CVE-2026-53049 affects the gfs2 file system within the Linux kernel.
When was CVE-2026-53049 published?
CVE-2026-53049 was published on June 24, 2026.