CVE-2026-63804

In the Linux kernel, the following vulnerability has been resolved:

gfs2: fix use-after-free in gfs2qddealloc

gfs2qddealloc(), called as an RCU callback from gfs2qddispose(), accesses the superblock object sdp through qd->qdsbd after freeing qd. It does so to decrement sdquotacount and wake up sdkill_wait.

However, by the time the RCU callback runs, gfs2putsuper() may have already freed sdp via freesbd(). This can happen when gfs2quotacleanup() is called during unmount: it disposes of quota objects via callrcu() and then waits on sdkillwait with a 60-second timeout. If the timeout expires, or if gfs2glhashclear() triggers additional qdput() calls that schedule more RCU callbacks after the wait completes, gfs2putsuper() will proceed to free the superblock while RCU callbacks referencing it are still pending.

Add an rcubarrier() before freesbd() in gfs2putsuper() to ensure all pending RCU callbacks (including gfs2qddealloc) have completed before the superblock is freed.