Medium 5.5Published Jun 24, 2026

CVE-2026-53048gfs2: prevent NULL pointer dereference during unmount

Updated under an hour ago (Oct 28, 2026, 4:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: gfs2: prevent NULL pointer dereference during unmount When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 24, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from c3c5cfa3170c0940bc66a142859caac07d19b9d6 before cec55674354794eddb80b914f73a6bf9b7fc304a; 5f6a84cfb33b34610623857bd93919dcb661e29b builds before 2fc4c868c9060f424fd4a7cacb0aec5082aba4de; 3429ef5f50909cee9e498c50f0c499b9397116ce builds before 233a0945a4b1dbe3f38c30afb7d05b76c67f1193; from 35264909e9d1973ab9aaa2a1b07cda70f12bb828 before e15f16761594e80b15776980b27c35477655a135; from 35264909e9d1973ab9aaa2a1b07cda70f12bb828 before d8ffae016c4a78693fe1283335d0b6833a9c1366; from 35264909e9d1973ab9aaa2a1b07cda70f12bb828 before abd73229f0e886a91a16ea781ab656bd9b4d1ee8; 35264909e9d1973ab9aaa2a1b07cda70f12bb828 builds before 74b4dbb946060a3233604d91859a9abd3708141d; f54f9d5368a4e92ede7dd078a62788dae3a7c6ef; and 4 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 5.15.200 before 5.15.209; from 6.1.162 before 6.1.175; from 6.6.37 before 6.6.141; from 6.9.8 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10	NVD

References

References

https://git.kernel.org/stable/c/cec55674354794eddb80b914f73a6bf9b7fc304a	patch
https://git.kernel.org/stable/c/2fc4c868c9060f424fd4a7cacb0aec5082aba4de	patch
https://git.kernel.org/stable/c/233a0945a4b1dbe3f38c30afb7d05b76c67f1193	patch
https://git.kernel.org/stable/c/e15f16761594e80b15776980b27c35477655a135	patch
https://git.kernel.org/stable/c/d8ffae016c4a78693fe1283335d0b6833a9c1366	patch
https://git.kernel.org/stable/c/abd73229f0e886a91a16ea781ab656bd9b4d1ee8	patch
https://git.kernel.org/stable/c/74b4dbb946060a3233604d91859a9abd3708141d	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.