LiveActive security incident?Get immediate response
CVE Record

CVE-2024-38570: gfs2: Fix potential glock use-after-free on unmount

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix potential glock use-after-free on unmount When a DLM lockspace is released and there ares still locks in that lockspace, DLM will unlock those locks automatically. Commit fb6791d100d1b started exploiting this behavior to speed up filesystem unmount: gfs2 would simply free glocks it didn't want to unlock and then release the lockspace. This didn't take the bast callbacks for asynchronous lock contention notifications into account, which remain active until until a lock is unlocked or its lockspace is released. To prevent those callbacks from accessing deallocated objects, put the glocks that should not be unlocked on the sd_dead_glocks list, release the lockspace, and only then free those glocks. As an additional measure, ignore unexpected ast and bast callbacks if the receiving glock is dead.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

CVE-2024-38570 is a Linux kernel GFS2 filesystem flaw. During unmount, lock callbacks could access glock objects after they were freed, creating a potential use-after-free condition. The public record does not provide CVSS scoring, impact detail, or exploitation evidence.

Executive priority

Treat this as a targeted Linux infrastructure issue, not a broad internet-facing emergency based on current evidence. Prioritize remediation for business-critical clustered storage using GFS2, and rely on vendor kernel guidance for timing and fixed package selection.

Technical view

GFS2 used DLM lockspace release behavior to speed unmount by freeing glocks before releasing the lockspace. Bast callbacks for asynchronous lock contention could remain active until lock unlock or lockspace release, potentially touching freed glocks. The fix defers freeing dead glocks until after lockspace release and ignores unexpected callbacks on dead glocks.

Likely exposure

Exposure is most relevant to Linux systems using GFS2 with DLM lockspaces, especially clustered filesystem deployments. The source bundle lists Linux kernel impact and stable kernel fix commits, but does not provide distribution-specific package names or complete affected version ranges.

Exploitation context

There is no KEV listing and no cited source in the bundle states active exploitation. The described trigger context is filesystem unmount with remaining DLM locks and active ast or bast callbacks. Public evidence is insufficient to assess practical exploitability.

Researcher notes

The source evidence supports a kernel memory safety defect in GFS2 unmount handling. Missing data includes CVSS, CWE, distribution mappings, exploitability analysis, and confirmed real-world exploitation. Avoid assuming privilege escalation or remote attack paths without additional vendor or researcher evidence.

Mitigation direction

  • Check Linux vendor advisories for CVE-2024-38570 and applicable backported kernels.
  • Update to a kernel containing the referenced stable GFS2 fixes.
  • Prioritize clustered systems using GFS2 and DLM lockspaces.
  • If patching is delayed, reduce unnecessary GFS2 exposure where operationally possible.
  • Track distribution-specific security errata for fixed package versions.

Validation and detection

  • Inventory Linux hosts that load or use GFS2.
  • Identify clustered filesystem systems using DLM lockspaces.
  • Compare running kernel builds against vendor advisories for CVE-2024-38570.
  • Confirm kernel changelogs include the referenced stable fix commits.
  • Review crash or unmount anomalies on GFS2 systems as supporting evidence.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2024-38570 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
2ADP providers
5Source links

SSVC decision data

CISA-ADPCISA Coordinator
Timestamp
Version
2.0.3
Exploitation: noneAutomatable: noTechnical Impact: partial

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

ADP provider summaries

CVECVE Program Container
CISA-ADPCISA ADP Vulnrichment
other:ssvc

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfb6791d100d1bba20b5cdbc4912e1f7086ec60f8, fb6791d100d1bba20b5cdbc4912e1f7086ec60f8, fb6791d100d1bba20b5cdbc4912e1f7086ec60f8, fb6791d100d1bba20b5cdbc4912e1f7086ec60f8unaffected
LinuxLinux3.8, 0, 6.6.33, 6.8.12, 6.9.3, 6.10affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.