CVE-2025-40242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-40242", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2025-04-16T07:20:57.181Z", "datePublished": "2025-12-04T15:31:31.497Z", "dateUpdated": "2026-10-15T22:02:41.268Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:46.271Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet. In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The window is opened by a local umount or a local filesystem withdraw, and the glock free is performed by local filesystem activity (inode eviction, glock shrinker, `glock_work_func`); the DLM bast that dereferences the freed object comes from an authenticated cluster peer on a private interconnect and cannot by itself create the dangling pointer. There is no network-facing service path into `gdlm_put_lock()`.\nAC:H - Exploitation requires winning a race whose opening the attacker does not control \u2014 `DFL_UNMOUNT` is set only by a root-driven umount or an error-driven withdraw \u2014 and additionally requires a DLM ast/bast for that exact resource to arrive after the free but before `dlm_release_lockspace()` completes, plus slab reuse after the RCU grace period. The author explicitly characterises it as an \"unlikely race\" in a \"small window of time\".\nPR:L - Once the teardown window is open (via administrator umount, cluster-manager failover, or a withdraw provoked by storage errors), an ordinary unprivileged user with access to the GFS2 mount drives the vulnerable side: normal file operations force glock disposal through `__gfs2_glock_put \u2192 lm_put_lock`, and creating inodes sprays `gfs2_glock_cachep` to groom the freed object. No capability check exists anywhere on that path.\nUI:N - The attacker only performs ordinary file operations on an already-mounted GFS2 filesystem; no victim must open a file, mount media, or take any deliberate action. The privileged unmount/withdraw is an environmental system state, accounted for in Attack Complexity rather than user interaction.\nS:U - The freed `struct gfs2_glock`, the DLM callback that writes into it, and any resulting corruption all live in the host kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object whose contents the attacker can groom by reallocating glocks, and `gdlm_ast()` reads `gl->gl_flags`, `gl->gl_dstamp`, `gl->gl_name.ln_type` and the `gl->gl_name.ln_sbd` pointer out of the freed memory before the dead-lockref guard, using `ln_sbd` as a dereference target \u2014 giving an attacker-steerable kernel read primitive.\nI:H - Three distinct writes hit the freed object: DLM's `lksb->sb_status`/`sb_flags` stores, `clear_bit(GLF_BLOCKING, &gl->gl_flags)`, and `gfs2_update_stats(&gl->gl_stats, ...)`; worse, `this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats)` turns a groomed pointer in the freed object into the destination of a read-modify-write, and a surviving lockref check leads into `gfs2_glock_complete()` and `gl->gl_ops` indirect calls \u2014 a control-flow hijack path.\nA:H - Dereferencing a freed glock from the DLM callback workqueue produces KASAN splats, oopses on garbage `ln_sbd`/`gl_ops` pointers, and `BUG()` in `gdlm_bast()` on an unrecognised mode, panicking the node. On a clustered filesystem, crashing the node also triggers fencing and cluster-wide recovery."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/lock_dlm.c"], "versions": [{"version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "5fdc1474e678eea1700aa266c0b7c2c96f81dd0d", "status": "affected", "versionType": "git"}, {"version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "4913592a3358f6ec366b8346b733d5e2360b08e1", "status": "affected", "versionType": "git"}, {"version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "279bde3bbb0ac0bad5c729dfa85983d75a5d7641", "status": "affected", "versionType": "git"}, {"version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "64c61b4ac645222fa7b724cef616c1f862a72a40", "status": "affected", "versionType": "git"}, {"version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "28c4d9bc0708956c1a736a9e49fee71b65deee81", "status": "affected", "versionType": "git"}, {"version": "6aa628c45875e7b8cca81ed9447a12a0e8f3504a", "status": "affected", "versionType": "git"}, {"version": "a97e75203733be0a4263a78fb7b29352be150c1c", "status": "affected", "versionType": "git"}, {"version": "3554b46204e67333e1fb8be0e93936fb08267c80", "status": "affected", "versionType": "git"}, {"version": "5cff77b9827a956d076168b56775aad23bce87e4", "status": "affected", "versionType": "git"}, {"version": "8deedce385d220f90e435f534d71d27526273515", "status": "affected", "versionType": "git"}, {"version": "2225a5cd2fbc2ef0e0f78e585db3844f60416a39", "status": "affected", "versionType": "git"}, {"version": "02e838963fdaa6ce8570b5389aecdc6cf1fb40b0", "status": "affected", "versionType": "git"}, {"version": "01eb3106f43335fdc02111358dae80a5c3fd324d", "status": "affected", "versionType": "git"}, {"version": "4.4.284", "lessThan": "4.5", "status": "affected", "versionType": "semver"}, {"version": "4.9.283", "lessThan": "4.10", "status": "affected", "versionType": "semver"}, {"version": "4.14.247", "lessThan": "4.15", "status": "affected", "versionType": "semver"}, {"version": "4.19.207", "lessThan": "4.20", "status": "affected", "versionType": "semver"}, {"version": "5.4.148", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.10.67", "lessThan": "5.11", "status": "affected", "versionType": "semver"}, {"version": "5.13.19", "lessThan": "5.14", "status": "affected", "versionType": "semver"}, {"version": "5.14.6", "lessThan": "5.15", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/lock_dlm.c"], "versions": [{"version": "5.15", "status": "affected"}, {"version": "0", "lessThan": "5.15", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.56", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.17.6", "lessThanOrEqual": "6.17.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.1.168"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.6.131"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.12.56"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.17.6"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15", "versionEndExcluding": "6.18"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.4.284"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.9.283"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.14.247"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.19.207"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.148"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.67"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14.6"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d"}, {"url": "https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1"}, {"url": "https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641"}, {"url": "https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40"}, {"url": "https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"}], "title": "gfs2: Fix unlikely race in gdlm_put_lock", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40242", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:20.770505Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T22:02:41.268Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-40242", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-15T21:58:20.770505Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T21:58:21.680Z"}}], "cna": {"title": "gfs2: Fix unlikely race in gdlm_put_lock", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The window is opened by a local umount or a local filesystem withdraw, and the glock free is performed by local filesystem activity (inode eviction, glock shrinker, `glock_work_func`); the DLM bast that dereferences the freed object comes from an authenticated cluster peer on a private interconnect and cannot by itself create the dangling pointer. There is no network-facing service path into `gdlm_put_lock()`.\nAC:H - Exploitation requires winning a race whose opening the attacker does not control \u2014 `DFL_UNMOUNT` is set only by a root-driven umount or an error-driven withdraw \u2014 and additionally requires a DLM ast/bast for that exact resource to arrive after the free but before `dlm_release_lockspace()` completes, plus slab reuse after the RCU grace period. The author explicitly characterises it as an \"unlikely race\" in a \"small window of time\".\nPR:L - Once the teardown window is open (via administrator umount, cluster-manager failover, or a withdraw provoked by storage errors), an ordinary unprivileged user with access to the GFS2 mount drives the vulnerable side: normal file operations force glock disposal through `__gfs2_glock_put \u2192 lm_put_lock`, and creating inodes sprays `gfs2_glock_cachep` to groom the freed object. No capability check exists anywhere on that path.\nUI:N - The attacker only performs ordinary file operations on an already-mounted GFS2 filesystem; no victim must open a file, mount media, or take any deliberate action. The privileged unmount/withdraw is an environmental system state, accounted for in Attack Complexity rather than user interaction.\nS:U - The freed `struct gfs2_glock`, the DLM callback that writes into it, and any resulting corruption all live in the host kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object whose contents the attacker can groom by reallocating glocks, and `gdlm_ast()` reads `gl->gl_flags`, `gl->gl_dstamp`, `gl->gl_name.ln_type` and the `gl->gl_name.ln_sbd` pointer out of the freed memory before the dead-lockref guard, using `ln_sbd` as a dereference target \u2014 giving an attacker-steerable kernel read primitive.\nI:H - Three distinct writes hit the freed object: DLM's `lksb->sb_status`/`sb_flags` stores, `clear_bit(GLF_BLOCKING, &gl->gl_flags)`, and `gfs2_update_stats(&gl->gl_stats, ...)`; worse, `this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats)` turns a groomed pointer in the freed object into the destination of a read-modify-write, and a surviving lockref check leads into `gfs2_glock_complete()` and `gl->gl_ops` indirect calls \u2014 a control-flow hijack path.\nA:H - Dereferencing a freed glock from the DLM callback workqueue produces KASAN splats, oopses on garbage `ln_sbd`/`gl_ops` pointers, and `BUG()` in `gdlm_bast()` on an unrecognised mode, panicking the node. On a clustered filesystem, crashing the node also triggers fencing and cluster-wide recovery."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "5fdc1474e678eea1700aa266c0b7c2c96f81dd0d", "versionType": "git"}, {"status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "4913592a3358f6ec366b8346b733d5e2360b08e1", "versionType": "git"}, {"status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "279bde3bbb0ac0bad5c729dfa85983d75a5d7641", "versionType": "git"}, {"status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "64c61b4ac645222fa7b724cef616c1f862a72a40", "versionType": "git"}, {"status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "lessThan": "28c4d9bc0708956c1a736a9e49fee71b65deee81", "versionType": "git"}, {"status": "affected", "version": "6aa628c45875e7b8cca81ed9447a12a0e8f3504a", "versionType": "git"}, {"status": "affected", "version": "a97e75203733be0a4263a78fb7b29352be150c1c", "versionType": "git"}, {"status": "affected", "version": "3554b46204e67333e1fb8be0e93936fb08267c80", "versionType": "git"}, {"status": "affected", "version": "5cff77b9827a956d076168b56775aad23bce87e4", "versionType": "git"}, {"status": "affected", "version": "8deedce385d220f90e435f534d71d27526273515", "versionType": "git"}, {"status": "affected", "version": "2225a5cd2fbc2ef0e0f78e585db3844f60416a39", "versionType": "git"}, {"status": "affected", "version": "02e838963fdaa6ce8570b5389aecdc6cf1fb40b0", "versionType": "git"}, {"status": "affected", "version": "01eb3106f43335fdc02111358dae80a5c3fd324d", "versionType": "git"}, {"status": "affected", "version": "4.4.284", "lessThan": "4.5", "versionType": "semver"}, {"status": "affected", "version": "4.9.283", "lessThan": "4.10", "versionType": "semver"}, {"status": "affected", "version": "4.14.247", "lessThan": "4.15", "versionType": "semver"}, {"status": "affected", "version": "4.19.207", "lessThan": "4.20", "versionType": "semver"}, {"status": "affected", "version": "5.4.148", "lessThan": "5.5", "versionType": "semver"}, {"status": "affected", "version": "5.10.67", "lessThan": "5.11", "versionType": "semver"}, {"status": "affected", "version": "5.13.19", "lessThan": "5.14", "versionType": "semver"}, {"status": "affected", "version": "5.14.6", "lessThan": "5.15", "versionType": "semver"}], "programFiles": ["fs/gfs2/lock_dlm.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"status": "unaffected", "version": "0", "lessThan": "5.15", "versionType": "semver"}, {"status": "unaffected", "version": "6.1.168", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.131", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.56", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.17.6", "versionType": "semver", "lessThanOrEqual": "6.17.*"}, {"status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/gfs2/lock_dlm.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d"}, {"url": "https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1"}, {"url": "https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641"}, {"url": "https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40"}, {"url": "https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet. In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.168", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.131", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.56", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.17.6", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18", "versionStartIncluding": "5.15"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.4.284"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.9.283"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.14.247"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "4.19.207"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.4.148"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.10.67"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.13.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "5.14.6"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:08:46.271Z"}}}, "cveMetadata": {"cveId": "CVE-2025-40242", "state": "PUBLISHED", "dateUpdated": "2026-10-15T22:02:41.268Z", "dateReserved": "2025-04-16T07:20:57.181Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2025-12-04T15:31:31.497Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/gfs2/lock_dlm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "5fdc1474e678eea1700aa266c0b7c2c96f81dd0d", "status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "versionType": "git"}, {"lessThan": "4913592a3358f6ec366b8346b733d5e2360b08e1", "status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "versionType": "git"}, {"lessThan": "279bde3bbb0ac0bad5c729dfa85983d75a5d7641", "status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "versionType": "git"}, {"lessThan": "64c61b4ac645222fa7b724cef616c1f862a72a40", "status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "versionType": "git"}, {"lessThan": "28c4d9bc0708956c1a736a9e49fee71b65deee81", "status": "affected", "version": "d1340f80f0b8066321b499a376780da00560e857", "versionType": "git"}, {"status": "affected", "version": "6aa628c45875e7b8cca81ed9447a12a0e8f3504a", "versionType": "git"}, {"status": "affected", "version": "a97e75203733be0a4263a78fb7b29352be150c1c", "versionType": "git"}, {"status": "affected", "version": "3554b46204e67333e1fb8be0e93936fb08267c80", "versionType": "git"}, {"status": "affected", "version": "5cff77b9827a956d076168b56775aad23bce87e4", "versionType": "git"}, {"status": "affected", "version": "8deedce385d220f90e435f534d71d27526273515", "versionType": "git"}, {"status": "affected", "version": "2225a5cd2fbc2ef0e0f78e585db3844f60416a39", "versionType": "git"}, {"status": "affected", "version": "02e838963fdaa6ce8570b5389aecdc6cf1fb40b0", "versionType": "git"}, {"status": "affected", "version": "01eb3106f43335fdc02111358dae80a5c3fd324d", "versionType": "git"}, {"lessThan": "4.5", "status": "affected", "version": "4.4.284", "versionType": "semver"}, {"lessThan": "4.10", "status": "affected", "version": "4.9.283", "versionType": "semver"}, {"lessThan": "4.15", "status": "affected", "version": "4.14.247", "versionType": "semver"}, {"lessThan": "4.20", "status": "affected", "version": "4.19.207", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.148", "versionType": "semver"}, {"lessThan": "5.11", "status": "affected", "version": "5.10.67", "versionType": "semver"}, {"lessThan": "5.14", "status": "affected", "version": "5.13.19", "versionType": "semver"}, {"lessThan": "5.15", "status": "affected", "version": "5.14.6", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/gfs2/lock_dlm.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.15"}, {"lessThan": "5.15", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.168", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.131", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.56", "versionType": "semver"}, {"lessThanOrEqual": "6.17.*", "status": "unaffected", "version": "6.17.6", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.18", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet. In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\ngfs2: Correcci\u00f3n de una condici\u00f3n de carrera improbable en gdlm_put_lock\n\nEn gdlm_put_lock(), existe una peque\u00f1a ventana de tiempo en la que la bandera DFL_UNMOUNT ha sido establecida, pero el lockspace a\u00fan no ha sido liberado. En esa ventana, dlm a\u00fan puede llamar a gdlm_ast() y gdlm_bast(). Para evitar que desreferencie objetos glock liberados, solo se debe liberar el glock si el lockspace ha sido realmente liberado."}], "id": "CVE-2025-40242", "lastModified": "2026-10-19T19:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.0, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-40242", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T21:58:20.770505Z", "version": "2.0.3"}}]}, "published": "2025-12-04T16:16:17.390", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Deferred"}

{"bugzilla": {"description": "kernel: gfs2: Fix unlikely race in gdlm_put_lock", "id": "2418819", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2418819"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\ngfs2: Fix unlikely race in gdlm_put_lock\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet. In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."], "name": "CVE-2025-40242", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2025-12-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2025-40242\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-40242\nhttps://lore.kernel.org/linux-cve-announce/2025120403-CVE-2025-40242-8f73@gregkh/T"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-20T17:39:11.152074+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a patched version that includes the gfs2 race condition fix (see the associated commit references).", "If an immediate kernel upgrade is not possible, avoid mounting GFS2 filesystems during system shutdown or when the system is untrusted, or ensure that GFS2 is cleanly unmounted before stopping the machine to eliminate the race window.", "Regularly monitor kernel security advisories and apply all subsequent patches to mitigate any related or new vulnerabilities."], "summary": {"action": "Patch Kernel", "impact": "Use-after-free leading to arbitrary code execution"}, "threat_synthesis": {"affected_systems": "The vulnerability affects Linux systems running the Linux kernel. No specific version ranges were provided, so any kernel that contains the unpatched gfs2 code may be vulnerable. The affected product is the Linux kernel itself.", "description_and_impact": "In the Linux kernel a race condition was discovered in the gfs2 filesystem where the function gdlm_put_lock() could free a glock object while the lockspace was still active. The race window occurs between setting the DFL_UNMOUNT flag and releasing the lockspace, during which dlm may still invoke gdlm_ast() or gdlm_bast(). When this happens the code may dereference a freed glock, potentially leading to a crash or, if exploited, arbitrary code execution. This reflects a classic use-after-free vulnerability (CWE\u2011416).", "risk_and_exploitability": "The CVSS score is 7.0, indicating medium severity. The EPSS score is less than 1\u202f%, suggesting exploitation probability is very low at this time. The issue is not listed in CISA\u2019s KEV catalogue. Based on the description, the likely attack vector requires local privileged access that can trigger a race, such as unmounting a GFS2 filesystem while the kernel is still holding the lockspace. An attacker who can achieve this race would immediately compromise system integrity and could obtain arbitrary code execution."}}}}, "created": "2026-04-20T17:45:12.953615+00:00", "updated": "2026-04-20T17:45:12.953626+00:00", "vendors": [], "weaknesses": ["CWE-416"]}