SECUFOCUSNOW
Home›CVE index›CVE-2026-63804
Review reviewHigh

CVE-2026-63804

Linux Linux, linux kernel

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.19
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: gfs2: fix use-after-free in gfs2_qd_dealloc gfs2_qd_dealloc(), called as an RCU callback from gfs2_qd_dispose(), accesses the superblock object sdp through qd->qd_sbd after freeing qd. It does so to decrement sd_quota_count and wake up sd_kill_wait. However, by the time the RCU callback runs, gfs2_put_super() may have already freed sdp via free_sbd(). This can happen when gfs2_quota_cleanup() is called during unmount: it disposes of quota objects via call_rcu() and then waits on sd_kill_wait with a 60-second timeout. If the...

Affected product and versions

Product
Linux Linux, linux kernel
Affected versions
>= a475c5dd16e57c570113eccba51955b5df8bb052 < 4fe388218826df8607ae41a6305df67db08a9093, >= a475c5dd16e57c570113eccba51955b5df8bb052 < 8745d9f7e1682c39f0a1578895ac74205e2a6757, >= a475c5dd16e57c570113eccba51955b5df8bb052 < b85ef03f726b15047a6fa6d11b639bdf6c0ee4f0, >= a475c5dd16e57c570113eccba51955b5df8bb052 < 9d0d5ba20cad661f7f287d4c66d2c19022ce2fd0, >= a475c5dd16e57c570113eccba51955b5df8bb052 < f9c9ec2c319f843b70ecdf939d48b52d189bc081, >= 6.6, >= 6.6 < 6.6.144, >= 6.7 < 6.12.95, >= 6.13 < 6.18.38, >= 6.19 < 7.1.3
Fixed versions
6.6.144, 6.12.95, 6.18.38, 7.1.3

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux Linux, linux kernel and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
CWE-416