{"id":"CVE-2025-40242","state":"PUBLISHED","title":"gfs2: Fix unlikely race in gdlm_put_lock","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released.","publishedAt":"2025-12-04T15:31:31.497Z","updatedAt":"2026-10-15T22:02:41.268Z","severity":{"score":7,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"5fdc1474e678eea1700aa266c0b7c2c96f81dd0d","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"4913592a3358f6ec366b8346b733d5e2360b08e1","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"279bde3bbb0ac0bad5c729dfa85983d75a5d7641","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"64c61b4ac645222fa7b724cef616c1f862a72a40","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"28c4d9bc0708956c1a736a9e49fee71b65deee81","versionType":"git"},{"version":"6aa628c45875e7b8cca81ed9447a12a0e8f3504a","status":"affected","versionType":"git"},{"version":"a97e75203733be0a4263a78fb7b29352be150c1c","status":"affected","versionType":"git"},{"version":"3554b46204e67333e1fb8be0e93936fb08267c80","status":"affected","versionType":"git"},{"version":"5cff77b9827a956d076168b56775aad23bce87e4","status":"affected","versionType":"git"},{"version":"8deedce385d220f90e435f534d71d27526273515","status":"affected","versionType":"git"},{"version":"2225a5cd2fbc2ef0e0f78e585db3844f60416a39","status":"affected","versionType":"git"},{"version":"02e838963fdaa6ce8570b5389aecdc6cf1fb40b0","status":"affected","versionType":"git"},{"version":"01eb3106f43335fdc02111358dae80a5c3fd324d","status":"affected","versionType":"git"},{"version":"4.4.284","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.283","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.247","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.207","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.148","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.67","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.13.19","status":"affected","lessThan":"5.14","versionType":"semver"},{"version":"5.14.6","status":"affected","lessThan":"5.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.56","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"]}],"references":["https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d","https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1","https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641","https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40","https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"],"weaknesses":[],"ingestedAt":"2026-10-29T20:09:09.358Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/40xxx/CVE-2025-40242.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40242","state":"PUBLISHED","datePublished":"2025-12-04T15:31:31.497Z","dateUpdated":"2026-10-15T22:02:41.268Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2025-04-16T07:20:57.181Z"},"containers":{"cna":{"title":"gfs2: Fix unlikely race in gdlm_put_lock","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"5fdc1474e678eea1700aa266c0b7c2c96f81dd0d","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"4913592a3358f6ec366b8346b733d5e2360b08e1","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"279bde3bbb0ac0bad5c729dfa85983d75a5d7641","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"64c61b4ac645222fa7b724cef616c1f862a72a40","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","status":"affected","lessThan":"28c4d9bc0708956c1a736a9e49fee71b65deee81","versionType":"git"},{"version":"6aa628c45875e7b8cca81ed9447a12a0e8f3504a","status":"affected","versionType":"git"},{"version":"a97e75203733be0a4263a78fb7b29352be150c1c","status":"affected","versionType":"git"},{"version":"3554b46204e67333e1fb8be0e93936fb08267c80","status":"affected","versionType":"git"},{"version":"5cff77b9827a956d076168b56775aad23bce87e4","status":"affected","versionType":"git"},{"version":"8deedce385d220f90e435f534d71d27526273515","status":"affected","versionType":"git"},{"version":"2225a5cd2fbc2ef0e0f78e585db3844f60416a39","status":"affected","versionType":"git"},{"version":"02e838963fdaa6ce8570b5389aecdc6cf1fb40b0","status":"affected","versionType":"git"},{"version":"01eb3106f43335fdc02111358dae80a5c3fd324d","status":"affected","versionType":"git"},{"version":"4.4.284","status":"affected","lessThan":"4.5","versionType":"semver"},{"version":"4.9.283","status":"affected","lessThan":"4.10","versionType":"semver"},{"version":"4.14.247","status":"affected","lessThan":"4.15","versionType":"semver"},{"version":"4.19.207","status":"affected","lessThan":"4.20","versionType":"semver"},{"version":"5.4.148","status":"affected","lessThan":"5.5","versionType":"semver"},{"version":"5.10.67","status":"affected","lessThan":"5.11","versionType":"semver"},{"version":"5.13.19","status":"affected","lessThan":"5.14","versionType":"semver"},{"version":"5.14.6","status":"affected","lessThan":"5.15","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"5.15","status":"affected"},{"version":"0","status":"unaffected","lessThan":"5.15","versionType":"semver"},{"version":"6.1.168","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.131","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.56","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.17.6","status":"unaffected","lessThanOrEqual":"6.17.*","versionType":"semver"},{"version":"6.18","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d"},{"url":"https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1"},{"url":"https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641"},{"url":"https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40"},{"url":"https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The window is opened by a local umount or a local filesystem withdraw, and the glock free is performed by local filesystem activity (inode eviction, glock shrinker, `glock_work_func`); the DLM bast that dereferences the freed object comes from an authenticated cluster peer on a private interconnect and cannot by itself create the dangling pointer. There is no network-facing service path into `gdlm_put_lock()`.\nAC:H - Exploitation requires winning a race whose opening the attacker does not control — `DFL_UNMOUNT` is set only by a root-driven umount or an error-driven withdraw — and additionally requires a DLM ast/bast for that exact resource to arrive after the free but before `dlm_release_lockspace()` completes, plus slab reuse after the RCU grace period. The author explicitly characterises it as an \"unlikely race\" in a \"small window of time\".\nPR:L - Once the teardown window is open (via administrator umount, cluster-manager failover, or a withdraw provoked by storage errors), an ordinary unprivileged user with access to the GFS2 mount drives the vulnerable side: normal file operations force glock disposal through `__gfs2_glock_put → lm_put_lock`, and creating inodes sprays `gfs2_glock_cachep` to groom the freed object. No capability check exists anywhere on that path.\nUI:N - The attacker only performs ordinary file operations on an already-mounted GFS2 filesystem; no victim must open a file, mount media, or take any deliberate action. The privileged unmount/withdraw is an environmental system state, accounted for in Attack Complexity rather than user interaction.\nS:U - The freed `struct gfs2_glock`, the DLM callback that writes into it, and any resulting corruption all live in the host kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object whose contents the attacker can groom by reallocating glocks, and `gdlm_ast()` reads `gl->gl_flags`, `gl->gl_dstamp`, `gl->gl_name.ln_type` and the `gl->gl_name.ln_sbd` pointer out of the freed memory before the dead-lockref guard, using `ln_sbd` as a dereference target — giving an attacker-steerable kernel read primitive.\nI:H - Three distinct writes hit the freed object: DLM's `lksb->sb_status`/`sb_flags` stores, `clear_bit(GLF_BLOCKING, &gl->gl_flags)`, and `gfs2_update_stats(&gl->gl_stats, ...)`; worse, `this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats)` turns a groomed pointer in the freed object into the destination of a read-modify-write, and a surviving lockref check leads into `gfs2_glock_complete()` and `gl->gl_ops` indirect calls — a control-flow hijack path.\nA:H - Dereferencing a freed glock from the DLM callback workqueue produces KASAN splats, oopses on garbage `ln_sbd`/`gl_ops` pointers, and `BUG()` in `gdlm_bast()` on an unrecognised mode, panicking the node. On a clustered filesystem, crashing the node also triggers fencing and cluster-wide recovery."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:08:46.271Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.17.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.284"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.283"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.207"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.67"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14.6"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-40242","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-15T21:58:20.770505Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-15T22:02:41.268Z"}}]}}}