{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2025-40242", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T15:31:31.497Z", "dateUpdated": "2026-08-05T12:08:46.271Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:46.271Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet. In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The window is opened by a local umount or a local filesystem withdraw, and the glock free is performed by local filesystem activity (inode eviction, glock shrinker, `glock_work_func`); the DLM bast that dereferences the freed object comes from an authenticated cluster peer on a private interconnect and cannot by itself create the dangling pointer. There is no network-facing service path into `gdlm_put_lock()`.\nAC:H - Exploitation requires winning a race whose opening the attacker does not control — `DFL_UNMOUNT` is set only by a root-driven umount or an error-driven withdraw — and additionally requires a DLM ast/bast for that exact resource to arrive after the free but before `dlm_release_lockspace()` completes, plus slab reuse after the RCU grace period. The author explicitly characterises it as an \"unlikely race\" in a \"small window of time\".\nPR:L - Once the teardown window is open (via administrator umount, cluster-manager failover, or a withdraw provoked by storage errors), an ordinary unprivileged user with access to the GFS2 mount drives the vulnerable side: normal file operations force glock disposal through `__gfs2_glock_put → lm_put_lock`, and creating inodes sprays `gfs2_glock_cachep` to groom the freed object. No capability check exists anywhere on that path.\nUI:N - The attacker only performs ordinary file operations on an already-mounted GFS2 filesystem; no victim must open a file, mount media, or take any deliberate action. The privileged unmount/withdraw is an environmental system state, accounted for in Attack Complexity rather than user interaction.\nS:U - The freed `struct gfs2_glock`, the DLM callback that writes into it, and any resulting corruption all live in the host kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object whose contents the attacker can groom by reallocating glocks, and `gdlm_ast()` reads `gl->gl_flags`, `gl->gl_dstamp`, `gl->gl_name.ln_type` and the `gl->gl_name.ln_sbd` pointer out of the freed memory before the dead-lockref guard, using `ln_sbd` as a dereference target — giving an attacker-steerable kernel read primitive.\nI:H - Three distinct writes hit the freed object: DLM's `lksb->sb_status`/`sb_flags` stores, `clear_bit(GLF_BLOCKING, &gl->gl_flags)`, and `gfs2_update_stats(&gl->gl_stats, ...)`; worse, `this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats)` turns a groomed pointer in the freed object into the destination of a read-modify-write, and a surviving lockref check leads into `gfs2_glock_complete()` and `gl->gl_ops` indirect calls — a control-flow hijack path.\nA:H - Dereferencing a freed glock from the DLM callback workqueue produces KASAN splats, oopses on garbage `ln_sbd`/`gl_ops` pointers, and `BUG()` in `gdlm_bast()` on an unrecognised mode, panicking the node. On a clustered filesystem, crashing the node also triggers fencing and cluster-wide recovery." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/gfs2/lock_dlm.c" ], "versions": [ { "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "5fdc1474e678eea1700aa266c0b7c2c96f81dd0d", "status": "affected", "versionType": "git" }, { "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "4913592a3358f6ec366b8346b733d5e2360b08e1", "status": "affected", "versionType": "git" }, { "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "279bde3bbb0ac0bad5c729dfa85983d75a5d7641", "status": "affected", "versionType": "git" }, { "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "64c61b4ac645222fa7b724cef616c1f862a72a40", "status": "affected", "versionType": "git" }, { "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "28c4d9bc0708956c1a736a9e49fee71b65deee81", "status": "affected", "versionType": "git" }, { "version": "6aa628c45875e7b8cca81ed9447a12a0e8f3504a", "status": "affected", "versionType": "git" }, { "version": "a97e75203733be0a4263a78fb7b29352be150c1c", "status": "affected", "versionType": "git" }, { "version": "3554b46204e67333e1fb8be0e93936fb08267c80", "status": "affected", "versionType": "git" }, { "version": "5cff77b9827a956d076168b56775aad23bce87e4", "status": "affected", "versionType": "git" }, { "version": "8deedce385d220f90e435f534d71d27526273515", "status": "affected", "versionType": "git" }, { "version": "2225a5cd2fbc2ef0e0f78e585db3844f60416a39", "status": "affected", "versionType": "git" }, { "version": "02e838963fdaa6ce8570b5389aecdc6cf1fb40b0", "status": "affected", "versionType": "git" }, { "version": "01eb3106f43335fdc02111358dae80a5c3fd324d", "status": "affected", "versionType": "git" }, { "version": "4.4.284", "lessThan": "4.5", "status": "affected", "versionType": "semver" }, { "version": "4.9.283", "lessThan": "4.10", "status": "affected", "versionType": "semver" }, { "version": "4.14.247", "lessThan": "4.15", "status": "affected", "versionType": "semver" }, { "version": "4.19.207", "lessThan": "4.20", "status": "affected", "versionType": "semver" }, { "version": "5.4.148", "lessThan": "5.5", "status": "affected", "versionType": "semver" }, { "version": "5.10.67", "lessThan": "5.11", "status": "affected", "versionType": "semver" }, { "version": "5.13.19", "lessThan": "5.14", "status": "affected", "versionType": "semver" }, { "version": "5.14.6", "lessThan": "5.15", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/gfs2/lock_dlm.c" ], "versions": [ { "version": "5.15", "status": "affected" }, { "version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.56", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.56" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17.6" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.284" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.283" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.247" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.207" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.148" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.67" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.19" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.6" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d" }, { "url": "https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1" }, { "url": "https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641" }, { "url": "https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40" }, { "url": "https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81" } ], "title": "gfs2: Fix unlikely race in gdlm_put_lock", "x_generator": { "engine": "bippy-1.2.0" } } } }