CVE-2026-53049

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53049", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.381Z", "datePublished": "2026-06-24T16:29:55.190Z", "dateUpdated": "2026-10-19T19:47:14.439Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:32:55.082Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: add some missing log locking\n\nFunction gfs2_logd() calls the log flushing functions gfs2_ail1_start(),\ngfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock,\nbut these functions require exclusion against concurrent transactions.\n\nTo fix that, add a non-locking __gfs2_log_flush() function. Then, in\ngfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log\nflushing functions and __gfs2_log_flush()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - GFS2 can back kernel NFS/ksmbd exports, and remote file create/write/unlink requests reach the GFS2 VFS paths that create transactions and wake gfs2_logd. A remote attacker therefore does not need local code execution on a reasonably deployed file server using GFS2 storage.\nAC:L - The race is driven by ordinary concurrent filesystem activity and log pressure, which an attacker can create by issuing repeated parallel writes/metadata operations. No rare hardware state or uncontrollable timing condition is required beyond normal kernel scheduling.\nPR:N - In the highest reasonable deployment, a writable NFS export or guest/share can allow anonymous or unauthenticated remote write activity to reach these paths. No kernel capability or local administrative privilege is required to trigger the vulnerable log/transaction interaction in that scenario.\nUI:N - Once the GFS2 filesystem is mounted/exported, exploitation only requires attacker-initiated filesystem operations. No separate victim action is needed during the attack.\nS:U - The affected component is the host kernel filesystem implementation, and the impact remains within that kernel/filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The missing exclusion can corrupt GFS2 log/revoke and AIL state, making stale or incorrect filesystem contents plausibly reachable after replay or recovery. Under the required uncertainty rule, filesystem journal corruption that can expose arbitrary stored data is scored as high confidentiality impact.\nI:H - The bug affects journal/log bookkeeping that protects filesystem metadata and replay ordering, so a triggered race can corrupt or roll back arbitrary filesystem state. This is high integrity impact for a shared GFS2 volume.\nA:H - The race can lead to GFS2 withdraws, hangs, assertion failures, or filesystem unavailability under log flushing pressure. That is a high availability impact for the affected kernel/filesystem instance."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/log.c"], "versions": [{"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "3b28eb75afe520972bacc833850c2b30aa0824cd", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "ca95342cb1b39062a03c115830286f0a426053d5", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "bf5fcd9c37c2546beaf7b401d31aefd89017dc3d", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "f2f225cf505ac016132ded21690f3ba0a080a4e8", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "49d9be0722da3a4a893ba905720cba1921834ec3", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "98e8bf249c790d56de1abc4a5f8bd68035a00921", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/log.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd"}, {"url": "https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5"}, {"url": "https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d"}, {"url": "https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8"}, {"url": "https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3"}, {"url": "https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921"}, {"url": "https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8"}], "title": "gfs2: add some missing log locking", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:24:53.809921Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:47:14.439Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-53049", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-06-09T07:44:35.381Z", "datePublished": "2026-06-24T16:29:55.190Z", "dateUpdated": "2026-10-19T19:47:14.439Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:32:55.082Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: add some missing log locking\n\nFunction gfs2_logd() calls the log flushing functions gfs2_ail1_start(),\ngfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock,\nbut these functions require exclusion against concurrent transactions.\n\nTo fix that, add a non-locking __gfs2_log_flush() function. Then, in\ngfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log\nflushing functions and __gfs2_log_flush()."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - GFS2 can back kernel NFS/ksmbd exports, and remote file create/write/unlink requests reach the GFS2 VFS paths that create transactions and wake gfs2_logd. A remote attacker therefore does not need local code execution on a reasonably deployed file server using GFS2 storage.\nAC:L - The race is driven by ordinary concurrent filesystem activity and log pressure, which an attacker can create by issuing repeated parallel writes/metadata operations. No rare hardware state or uncontrollable timing condition is required beyond normal kernel scheduling.\nPR:N - In the highest reasonable deployment, a writable NFS export or guest/share can allow anonymous or unauthenticated remote write activity to reach these paths. No kernel capability or local administrative privilege is required to trigger the vulnerable log/transaction interaction in that scenario.\nUI:N - Once the GFS2 filesystem is mounted/exported, exploitation only requires attacker-initiated filesystem operations. No separate victim action is needed during the attack.\nS:U - The affected component is the host kernel filesystem implementation, and the impact remains within that kernel/filesystem security authority. This is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The missing exclusion can corrupt GFS2 log/revoke and AIL state, making stale or incorrect filesystem contents plausibly reachable after replay or recovery. Under the required uncertainty rule, filesystem journal corruption that can expose arbitrary stored data is scored as high confidentiality impact.\nI:H - The bug affects journal/log bookkeeping that protects filesystem metadata and replay ordering, so a triggered race can corrupt or roll back arbitrary filesystem state. This is high integrity impact for a shared GFS2 volume.\nA:H - The race can lead to GFS2 withdraws, hangs, assertion failures, or filesystem unavailability under log flushing pressure. That is a high availability impact for the affected kernel/filesystem instance."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/log.c"], "versions": [{"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "3b28eb75afe520972bacc833850c2b30aa0824cd", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "ca95342cb1b39062a03c115830286f0a426053d5", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "bf5fcd9c37c2546beaf7b401d31aefd89017dc3d", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "f2f225cf505ac016132ded21690f3ba0a080a4e8", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "49d9be0722da3a4a893ba905720cba1921834ec3", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "98e8bf249c790d56de1abc4a5f8bd68035a00921", "status": "affected", "versionType": "git"}, {"version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "lessThan": "fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/gfs2/log.c"], "versions": [{"version": "5.7", "status": "affected"}, {"version": "0", "lessThan": "5.7", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.6.141"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.12.91"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "6.18.33"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.0.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.7", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd"}, {"url": "https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5"}, {"url": "https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d"}, {"url": "https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8"}, {"url": "https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3"}, {"url": "https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921"}, {"url": "https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8"}], "title": "gfs2: add some missing log locking", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-53049", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:24:53.809921Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:24:54.346Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/gfs2/log.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3b28eb75afe520972bacc833850c2b30aa0824cd", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "ca95342cb1b39062a03c115830286f0a426053d5", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "bf5fcd9c37c2546beaf7b401d31aefd89017dc3d", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "f2f225cf505ac016132ded21690f3ba0a080a4e8", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "49d9be0722da3a4a893ba905720cba1921834ec3", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "98e8bf249c790d56de1abc4a5f8bd68035a00921", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}, {"lessThan": "fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8", "status": "affected", "version": "5e4c7632aae1cce137792647f4fb6f599d1da893", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/gfs2/log.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.7"}, {"lessThan": "5.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.141", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.91", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.33", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0835A3B8-EEC4-483D-BD00-9F31989A98E7", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "97A9FFFA-22BB-4D5C-9790-5A2286E392F7", "versionEndExcluding": "6.6.141", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C918746B-DE6F-448F-A93E-A04C5481688D", "versionEndExcluding": "6.12.91", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "96D99E49-380D-43AB-BDBA-25C3AD018A9C", "versionEndExcluding": "6.18.33", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A13475D2-59BF-4716-94B5-7C1D239A2CF4", "versionEndExcluding": "7.0.10", "versionStartIncluding": "6.19", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: add some missing log locking\n\nFunction gfs2_logd() calls the log flushing functions gfs2_ail1_start(),\ngfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock,\nbut these functions require exclusion against concurrent transactions.\n\nTo fix that, add a non-locking __gfs2_log_flush() function. Then, in\ngfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log\nflushing functions and __gfs2_log_flush()."}], "id": "CVE-2026-53049", "lastModified": "2026-10-19T20:18:57.120", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-53049", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:24:53.809921Z", "version": "2.0.3"}}]}, "published": "2026-06-24T17:17:16.777", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3b28eb75afe520972bacc833850c2b30aa0824cd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/49d9be0722da3a4a893ba905720cba1921834ec3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/98e8bf249c790d56de1abc4a5f8bd68035a00921"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/bf5fcd9c37c2546beaf7b401d31aefd89017dc3d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/ca95342cb1b39062a03c115830286f0a426053d5"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f2f225cf505ac016132ded21690f3ba0a080a4e8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-667"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: gfs2: add some missing log locking", "id": "2492276", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492276"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-414", "details": ["A flaw was found in the Linux kernel's Global File System 2 (GFS2) component. The `gfs2_logd()` function, responsible for log flushing, calls several log flushing functions without holding the required lock. This omission allows concurrent transactions to access shared resources without proper exclusion, which could lead to race conditions. Such conditions may result in system instability or data corruption, potentially causing a Denial of Service (DoS)."], "name": "CVE-2026-53049", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-06-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-53049\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53049\nhttps://lore.kernel.org/linux-cve-announce/2026062459-CVE-2026-53049-7013@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,3b28eb75afe520972bacc833850c2b30aa0824cd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,ca95342cb1b39062a03c115830286f0a426053d5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,bf5fcd9c37c2546beaf7b401d31aefd89017dc3d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,f2f225cf505ac016132ded21690f3ba0a080a4e8)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,49d9be0722da3a4a893ba905720cba1921834ec3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,98e8bf249c790d56de1abc4a5f8bd68035a00921)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5e4c7632aae1cce137792647f4fb6f599d1da893,fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.7"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.7)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.209,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.175,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.141,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.91,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.33,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.10,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-06-24T19:30:08.642946+00:00", "updated": "2026-10-23T00:30:08.824639+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}