CVE-2026-53048
In the Linux kernel, the following vulnerability has been resolved: gfs2: prevent NULL pointer dereference during unmount When flushing out outstanding glock work during an unmount, gfs2_log_flush() can be called when sdp->sd_jdesc has already been deallocated and sdp->sd_jdesc is NULL. Commit 35264909e9d1 ("gfs2: Fix NULL pointer dereference in gfs2_log_flush") added a check for that to gfs2_log_flush() itself, but it missed the sdp->sd_jdesc dereference in gfs2_log_release(). Fix that.
Affected versions
Linux kernel versions
5.15.200,
6.1.162,
6.6.37,
6.9.8,
6.10
and later are affected. Fixed in
5.15.209,
6.1.175,
6.6.141,
6.12.91,
6.18.33,
7.0.10,
7.1
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-53048?
CVE-2026-53048 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.15.200 onward and has been patched in 5.15.209, 6.1.175, 6.6.141 and others. CVE-2026-53048 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-53048?
Yes — CVE-2026-53048 has been patched. Fixed versions include 5.15.209, 6.1.175, 6.6.141 and others. If you are running Linux kernel 5.15.200 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-53048 actively exploited?
No — CVE-2026-53048 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.