---
id: CVE-2026-45961
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gfs2: fix memory leaks in gfs2_fill_super error path

  Fix two memory leaks in the gfs2_fill_super() error handling path when
  transitioning a filesystem to read-write mo…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gfs2: fix memory leaks in gfs2_fill_super error path

  Fix two memory leaks in the gfs2_fill_super() error handling path when
  transitioning a filesystem to read-write mo…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-401
vendor: linux
product: linux_kernel
affected:
  - 'linux_kernel >= 5.10.173, < 5.11'
  - 'linux_kernel >= 5.15.99, < 5.16'
  - 'linux_kernel >= 6.1.16, < 6.2'
  - 'linux_kernel >= 6.2.3, < 6.19.4'
patched:
  - linux_kernel 6.19.4
published: '2026-05-27'
updated: '2026-10-15'
sourceUpdated: '2026-10-15T11:17:31.467'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-45961'
references:
  - url: 'https://git.kernel.org/stable/c/4456be93464a599eac0eb2afa63b5d662e1599d8'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/da6f5bbc2e7902f578b503f2a4c3d8d09ca4b102'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e54229ecf49add8451d5f765a32c86ab4446e06c'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
epss: 0.00143
epssPercentile: 0.03213
ingestedAt: '2026-10-15T11:00:41.704Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gfs2: fix memory leaks in gfs2_fill_super error path

Fix two memory leaks in the gfs2_fill_super() error handling path when
transitioning a filesystem to read-write mode fails.

First leak: kthread objects (thread_struct, task_struct, etc.)
When gfs2_freeze_lock_shared() fails after init_threads() succeeds, the
created kernel threads (logd and quotad) are never destroyed. This
occurs because the fail_per_node label doesn't call
gfs2_destroy_threads().

Second leak: quota bitmap buffer (8192 bytes)
When gfs2_make_fs_rw() fails after gfs2_quota_init() succeeds but
before other operations complete, the allocated quota bitmap is never
freed.

The fix moves thread cleanup to the fail_per_node label to handle all
error paths uniformly. gfs2_destroy_threads() is safe to call
unconditionally as it checks for NULL pointers. Quota cleanup is added
in gfs2_make_fs_rw() to properly handle the withdrawal case where
quota initialization succeeds but the filesystem is then withdrawn.

Thread leak backtrace (gfs2_freeze_lock_shared failure):
  unreferenced object 0xffff88801d7bca80 (size 4480):
    copy_process+0x3a1/0x4670 kernel/fork.c:2422
    kernel_clone+0xf3/0x6e0 kernel/fork.c:2779
    kthread_create_on_node+0x100/0x150 kernel/kthread.c:478
    init_threads+0xab/0x350 fs/gfs2/ops_fstype.c:611
    gfs2_fill_super+0xe5c/0x1240 fs/gfs2/ops_fstype.c:1265

Quota leak backtrace (gfs2_make_fs_rw failure):
  unreferenced object 0xffff88812de7c000 (size 8192):
    gfs2_quota_init+0xe5/0x820 fs/gfs2/quota.c:1409
    gfs2_make_fs_rw+0x7a/0xe0 fs/gfs2/super.c:149
    gfs2_fill_super+0xfbb/0x1240 fs/gfs2/ops_fstype.c:1275

## Affected

- `linux_kernel >= 5.10.173, < 5.11`
- `linux_kernel >= 5.15.99, < 5.16`
- `linux_kernel >= 6.1.16, < 6.2`
- `linux_kernel >= 6.2.3, < 6.19.4`

## Remediation

Upgrade past the affected range:

- `linux_kernel 6.19.4`