Critical Vulnerability in Linux Kernel: gfs2 Self Recovery Flaw
Summary
CVE-2025-38659: In the Linux kernel, the following vulnerability has been resolved: gfs2: No more self recovery When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to rep... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware management and system resources. It supports a wide range of functionalities, including process management, memory management, and file systems. The gfs2 (Global File System 2) is a clustered file system designed for high availability and performance in multi-node environments. This vulnerability affects gfs2's self-recovery mechanism, which is intended to maintain filesystem consistency during node withdrawals.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the gfs2 file system related to its self-recovery process. When a node withdraws from the cluster and is the only one with the filesystem mounted, gfs2 attempts to replay the local journal to restore consistency. This approach is flawed and has never functioned correctly, as the recovery function refuses to operate during a withdrawal. Furthermore, the function dereferences a pointer that can lead to a use-after-free condition or a NULL pointer dereference, resulting in potential system instability or crashes.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate potential risks.
Conclusion
The gfs2 self-recovery vulnerability in the Linux kernel poses significant risks to system stability and data integrity. It is crucial for users to apply the available patch promptly and to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their software environments.
See every vulnerability recorded for linux →
FAQ
The vulnerability involves a flawed self-recovery mechanism that can lead to system instability due to improper handling of filesystem consistency during node withdrawals.
If exploited, this vulnerability can cause crashes or instability in systems using the gfs2 file system, potentially leading to data loss or downtime.
Yes, a patch is available in version 6.16.3-1 for Debian 14. Users should update their Linux packages to this version to mitigate the vulnerability.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. It requires only a manifest file like package-lock.json.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
