Strix
26.1K

CVE-2025-40242

HIGHCVSS 7/10EPSS 0.18%

Last modified

CVE-2025-40242 is a high-severity vulnerability rated 7/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.. EPSS estimates a 0.18% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.18%

7.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= d1340f80f0b8066321b499a376780da00560e857, < 5fdc1474e678eea1700aa266c0b7c2c96f81dd0d; >= d1340f80f0b8066321b499a376780da00560e857, < 4913592a3358f6ec366b8346b733d5e2360b08e1; >= d1340f80f0b8066321b499a376780da00560e857, < 279bde3bbb0ac0bad5c729dfa85983d75a5d7641; >= d1340f80f0b8066321b499a376780da00560e857, < 64c61b4ac645222fa7b724cef616c1f862a72a40; >= d1340f80f0b8066321b499a376780da00560e857, < 28c4d9bc0708956c1a736a9e49fee71b65deee81; 6aa628c45875e7b8cca81ed9447a12a0e8f3504a; a97e75203733be0a4263a78fb7b29352be150c1c; 3554b46204e67333e1fb8be0e93936fb08267c80; 5cff77b9827a956d076168b56775aad23bce87e4; 8deedce385d220f90e435f534d71d27526273515; 2225a5cd2fbc2ef0e0f78e585db3844f60416a39; 02e838963fdaa6ce8570b5389aecdc6cf1fb40b0; 01eb3106f43335fdc02111358dae80a5c3fd324d; >= 4.4.284, < 4.5; >= 4.9.283, < 4.10; >= 4.14.247, < 4.15; >= 4.19.207, < 4.20; >= 5.4.148, < 5.5; >= 5.10.67, < 5.11; >= 5.13.19, < 5.14; >= 5.14.6, < 5.15
LinuxLinux5.15

References

Timeline

Published
Last Modified
Status
Deferred

Frequently Asked Questions

What is CVE-2025-40242?
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix unlikely race in gdlm_put_lock In gdlm_put_lock(), there is a small window of time in which the DFL_UNMOUNT flag has been set but the lockspace hasn't been released, yet. In that window, dlm may still call gdlm_ast() and gdlm_bast(). To prevent it from dereferencing freed glock objects, only free the glock if the lockspace has actually been released.
How severe is CVE-2025-40242?
CVE-2025-40242 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 0.18% probability of exploitation in the next 30 days.
How do I fix CVE-2025-40242?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2025

View all 2025CVEs →

Are you affected by CVE-2025-40242?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST