The Linux kernel's GFS2 filesystem had a use-after-free vulnerability (CVE-2026-63804) in the gfs2_qd_dealloc() function, which is called as an RCU callback from gfs2_qd_dispose(). The function accesses the superblock object (sdp) via qd->qd_sbd after qd has been freed. Since gfs2_put_super() may free the superblock via free_sbd() while RCU callbacks are still pending, this leads to use-after-free. The vulnerability occurs during unmount when gfs2_quota_cleanup() disposes quota objects with call_rcu() and waits on sd_kill_wait. If the wait times out or additional RCU callbacks are scheduled after the wait, the superblock can be freed prematurely. The fix adds an rcu_barrier() before free_sbd() in gfs2_put_super() to ensure all RCU callbacks complete before freeing the superblock.

This vulnerability allows a use-after-free condition in the Linux kernel's GFS2 filesystem code, which can lead to memory corruption. The CVSS vector indicates high impact on confidentiality, integrity, and availability (C:H/I:H/A:H), meaning an attacker with local privileges could potentially execute arbitrary code, cause denial of service, or compromise system integrity.

A fix has been implemented that adds an rcu_barrier() call before freeing the superblock in gfs2_put_super(), ensuring all pending RCU callbacks complete before the superblock is freed. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not yet confirmed from vendor advisory; check the Linux kernel vendor advisory for current remediation guidance.