CVE-2026-53049: gfs2: add some missing log locking

Synopsis

This is a missing lock (race condition) vulnerability in the Linux kernel's GFS2 clustered filesystem driver. It is reachable over the network without any authentication or user interaction, based on the CVSS:3.1/AV:N/AC:L/PR:N/UI:N vector. Successful exploitation gives an attacker full read, write, and denial-of-service capability against the affected system. Patched-image rebuilds at versions 5.15.209, 6.1.175, and the named commit SHAs are available on HarborGuard for environments running an affected kernel version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The vulnerable code path is reachable over the network, meaning an attacker must be able to send requests to the exposed service; no local shell or physical access is required.

• AuthenticationNot required

  No credentials or account of any privilege level are needed to trigger the vulnerability.

• Victim interactionNot required

  The exploit completes without any action from a logged-in user or administrator on the target system.

• Attack complexityDetail

  Attack complexity is Low, meaning the exploit is reliable and requires no special environmental conditions, race-window timing, or memory-layout knowledge beyond sending a crafted request.

Blast Radius

• A successful attacker reads arbitrary kernel memory, including stored credentials, session tokens, and filesystem data.
• A successful attacker writes to kernel memory or filesystem structures, corrupting persisted data or escalating privileges.
• A successful attacker crashes the affected kernel or filesystem subsystem, taking down all workloads on the host.
• Because the GFS2 driver is a shared clustered filesystem component, a single exploited node can disrupt other nodes sharing the same GFS2 volume.