CVE-2026-53049: linux Improper Locking
Vulnerability summary
CVE-2026-53049 is a critical (CVSS 9.8) Improper Locking vulnerability in linux. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 53 · Related 50Timeline
- 24-06-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: gfs2: add some missing log locking Function gfs2_logd() calls the log flushing functions gfs2_ail1_start(), gfs2_ail1_wait(), and gfs2_ail1_empty() without holding sdp->sd_log_flush_lock, but these functions require exclusion against concurrent transactions. To fix that, add a non-locking __gfs2_log_flush() function. Then, in gfs2_logd(), take sdp->sd_log_flush_lock before calling the above mentioned log flushing functions and __gfs2_log_flush().
CVSS metrics
5 scores · 4 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.39%
Chance of exploitation in the next 30 days
Percentile
31%
Versus all other CVEs
30-day change
0.00 pp
From 0.39% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-667Improper LockingThe product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
- CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.
Affected systems
Ubuntu154 products
- linux< 5.15.0-186.196 | < 6.8.0-136.136 | All versions (No fix recorded) | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-aws< 5.15.0-1112.119 | < 6.8.0-1061.64 | All versions (No fix recorded) | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < 3b28eb75afe520972bacc833850c2b30aa0824cd | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < ca95342cb1b39062a03c115830286f0a426053d5 | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < bf5fcd9c37c2546beaf7b401d31aefd89017dc3d | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < f2f225cf505ac016132ded21690f3ba0a080a4e8 | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < 49d9be0722da3a4a893ba905720cba1921834ec3 | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < 98e8bf249c790d56de1abc4a5f8bd68035a00921 | ≥ 5e4c7632aae1cce137792647f4fb6f599d1da893, < fe2c8d051150b90b3ccb85f89e3b1d636cb88ec8 | 5.7
- linux_kernel≥ 5.7, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.10-1
3 vendors · 157 products
