CVE-2025-38659 gfs2: No more self recovery
A null pointer dereference in the Linux kernel GFS2 filesystem can cause a denial of service when a node withdraws while being the only mounted node.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-38659?
CVE-2025-38659 is a high-severity vulnerability in Linux kernel, published on 22 Aug 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
gfs2: No more self recovery
When a node withdraws and it turns out that it is the only node that has the filesystem mounted, gfs2 currently tries to replay the local journal to bring the filesystem back into a consistent state. Not only is that a very bad idea, it has also never worked because gfs2_recover_func() will refuse to do anything during a withdraw.
However, before even getting to this point, gfs2_recover_func() dereferences sdp->sd_jdesc->jd_inode. This was a use-after-free before commit 04133b607a78 ("gfs2: Prevent double iput for journal on error") and is a NULL pointer dereference since then.
Simply get rid of self recovery to fix that.
Weakness: CWE-476
Which versions are affected by CVE-2025-38659?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2025-38659?
Apply the vendor's patch.
Is CVE-2025-38659 being exploited?
There is no known exploitation of CVE-2025-38659 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-66578, BELL-CVE-2025-38659, DEBIAN-CVE-2025-38659, GHSA-hx42-fcj6-qc8x, ROOT-OS-DEBIAN-11-CVE-2025-38659, ROOT-OS-DEBIAN-12-CVE-2025-38659 and 4 more.