{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-40242","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2025-04-16T07:20:57.181Z","datePublished":"2025-12-04T15:31:31.497Z","dateUpdated":"2026-08-05T12:08:46.271Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:08:46.271Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix unlikely race in gdlm_put_lock\n\nIn gdlm_put_lock(), there is a small window of time in which the\nDFL_UNMOUNT flag has been set but the lockspace hasn't been released,\nyet.  In that window, dlm may still call gdlm_ast() and gdlm_bast().\nTo prevent it from dereferencing freed glock objects, only free the\nglock if the lockspace has actually been released."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The window is opened by a local umount or a local filesystem withdraw, and the glock free is performed by local filesystem activity (inode eviction, glock shrinker, `glock_work_func`); the DLM bast that dereferences the freed object comes from an authenticated cluster peer on a private interconnect and cannot by itself create the dangling pointer. There is no network-facing service path into `gdlm_put_lock()`.\nAC:H - Exploitation requires winning a race whose opening the attacker does not control — `DFL_UNMOUNT` is set only by a root-driven umount or an error-driven withdraw — and additionally requires a DLM ast/bast for that exact resource to arrive after the free but before `dlm_release_lockspace()` completes, plus slab reuse after the RCU grace period. The author explicitly characterises it as an \"unlikely race\" in a \"small window of time\".\nPR:L - Once the teardown window is open (via administrator umount, cluster-manager failover, or a withdraw provoked by storage errors), an ordinary unprivileged user with access to the GFS2 mount drives the vulnerable side: normal file operations force glock disposal through `__gfs2_glock_put → lm_put_lock`, and creating inodes sprays `gfs2_glock_cachep` to groom the freed object. No capability check exists anywhere on that path.\nUI:N - The attacker only performs ordinary file operations on an already-mounted GFS2 filesystem; no victim must open a file, mount media, or take any deliberate action. The privileged unmount/withdraw is an environmental system state, accounted for in Attack Complexity rather than user interaction.\nS:U - The freed `struct gfs2_glock`, the DLM callback that writes into it, and any resulting corruption all live in the host kernel's own security authority. No hypervisor, IOMMU, or sandbox boundary is crossed.\nC:H - This is a use-after-free on a slab object whose contents the attacker can groom by reallocating glocks, and `gdlm_ast()` reads `gl->gl_flags`, `gl->gl_dstamp`, `gl->gl_name.ln_type` and the `gl->gl_name.ln_sbd` pointer out of the freed memory before the dead-lockref guard, using `ln_sbd` as a dereference target — giving an attacker-steerable kernel read primitive.\nI:H - Three distinct writes hit the freed object: DLM's `lksb->sb_status`/`sb_flags` stores, `clear_bit(GLF_BLOCKING, &gl->gl_flags)`, and `gfs2_update_stats(&gl->gl_stats, ...)`; worse, `this_cpu_ptr(gl->gl_name.ln_sbd->sd_lkstats)` turns a groomed pointer in the freed object into the destination of a read-modify-write, and a surviving lockref check leads into `gfs2_glock_complete()` and `gl->gl_ops` indirect calls — a control-flow hijack path.\nA:H - Dereferencing a freed glock from the DLM callback workqueue produces KASAN splats, oopses on garbage `ln_sbd`/`gl_ops` pointers, and `BUG()` in `gdlm_bast()` on an unrecognised mode, panicking the node. On a clustered filesystem, crashing the node also triggers fencing and cluster-wide recovery."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"],"versions":[{"version":"d1340f80f0b8066321b499a376780da00560e857","lessThan":"5fdc1474e678eea1700aa266c0b7c2c96f81dd0d","status":"affected","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","lessThan":"4913592a3358f6ec366b8346b733d5e2360b08e1","status":"affected","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","lessThan":"279bde3bbb0ac0bad5c729dfa85983d75a5d7641","status":"affected","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","lessThan":"64c61b4ac645222fa7b724cef616c1f862a72a40","status":"affected","versionType":"git"},{"version":"d1340f80f0b8066321b499a376780da00560e857","lessThan":"28c4d9bc0708956c1a736a9e49fee71b65deee81","status":"affected","versionType":"git"},{"version":"6aa628c45875e7b8cca81ed9447a12a0e8f3504a","status":"affected","versionType":"git"},{"version":"a97e75203733be0a4263a78fb7b29352be150c1c","status":"affected","versionType":"git"},{"version":"3554b46204e67333e1fb8be0e93936fb08267c80","status":"affected","versionType":"git"},{"version":"5cff77b9827a956d076168b56775aad23bce87e4","status":"affected","versionType":"git"},{"version":"8deedce385d220f90e435f534d71d27526273515","status":"affected","versionType":"git"},{"version":"2225a5cd2fbc2ef0e0f78e585db3844f60416a39","status":"affected","versionType":"git"},{"version":"02e838963fdaa6ce8570b5389aecdc6cf1fb40b0","status":"affected","versionType":"git"},{"version":"01eb3106f43335fdc02111358dae80a5c3fd324d","status":"affected","versionType":"git"},{"version":"4.4.284","lessThan":"4.5","status":"affected","versionType":"semver"},{"version":"4.9.283","lessThan":"4.10","status":"affected","versionType":"semver"},{"version":"4.14.247","lessThan":"4.15","status":"affected","versionType":"semver"},{"version":"4.19.207","lessThan":"4.20","status":"affected","versionType":"semver"},{"version":"5.4.148","lessThan":"5.5","status":"affected","versionType":"semver"},{"version":"5.10.67","lessThan":"5.11","status":"affected","versionType":"semver"},{"version":"5.13.19","lessThan":"5.14","status":"affected","versionType":"semver"},{"version":"5.14.6","lessThan":"5.15","status":"affected","versionType":"semver"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["fs/gfs2/lock_dlm.c"],"versions":[{"version":"5.15","status":"affected"},{"version":"0","lessThan":"5.15","status":"unaffected","versionType":"semver"},{"version":"6.1.168","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.131","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.56","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.17.6","lessThanOrEqual":"6.17.*","status":"unaffected","versionType":"semver"},{"version":"6.18","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.1.168"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.6.131"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.12.56"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.17.6"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.15","versionEndExcluding":"6.18"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.4.284"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.9.283"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.14.247"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"4.19.207"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.4.148"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.10.67"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.13.19"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"5.14.6"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/5fdc1474e678eea1700aa266c0b7c2c96f81dd0d"},{"url":"https://git.kernel.org/stable/c/4913592a3358f6ec366b8346b733d5e2360b08e1"},{"url":"https://git.kernel.org/stable/c/279bde3bbb0ac0bad5c729dfa85983d75a5d7641"},{"url":"https://git.kernel.org/stable/c/64c61b4ac645222fa7b724cef616c1f862a72a40"},{"url":"https://git.kernel.org/stable/c/28c4d9bc0708956c1a736a9e49fee71b65deee81"}],"title":"gfs2: Fix unlikely race in gdlm_put_lock","x_generator":{"engine":"bippy-1.2.0"}}}}