High 7.0Published Dec 4, 2025

CVE-2025-40242gfs2: Fix unlikely race in gdlm_put_lock

Updated under an hour ago (Oct 27, 2026, 1:10 PM ET)

Does this affect you?

It affects Linux. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.

CVSS: 7.0 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Deferred
Record last updated: Oct 15, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from d1340f80f0b8066321b499a376780da00560e857 before 5fdc1474e678eea1700aa266c0b7c2c96f81dd0d; from d1340f80f0b8066321b499a376780da00560e857 before 4913592a3358f6ec366b8346b733d5e2360b08e1; from d1340f80f0b8066321b499a376780da00560e857 before 279bde3bbb0ac0bad5c729dfa85983d75a5d7641; from d1340f80f0b8066321b499a376780da00560e857 before 64c61b4ac645222fa7b724cef616c1f862a72a40; from d1340f80f0b8066321b499a376780da00560e857 before 28c4d9bc0708956c1a736a9e49fee71b65deee81; 6aa628c45875e7b8cca81ed9447a12a0e8f3504a; a97e75203733be0a4263a78fb7b29352be150c1c; 3554b46204e67333e1fb8be0e93936fb08267c80; and 13 more ranges	CNA record

References

References

https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d
https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1
https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641
https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40
https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.