CVE-2026-45984gfs2: Fix use-after-free in iomap inline data write path
Updated under an hour ago ()
Does this affect you?
It affects Linux and 11 other products. Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area. The bug sequence: 1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh 2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) 3. Calls release_metapath() which calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report) 5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data 6. KASAN detects use-after-free write to freed memory Fix by storing dibh in iomap->private and incrementing its refcount with get_bh() in gfs2_iomap_begin(). The buffer is then properly released in gfs2_iomap_end() after the inline write completes, ensuring the page stays alive for the entire iomap operation. Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use. [agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid leaks in gfs2_iomap_get() and gfs2_iomap_alloc().]
- CVSS
- 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness (CWE)
- CWE-826
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- Linux
- NVD analysis
- Modified
- Record last updated
- Oct 16, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Linux Linux linux:linux (from the name) | from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 1403989d1b502f4a2c0d0b42ccf1c25748442eff; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 1cae1bafdf9caa9b462b19af06b1a06902e4e142; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 764c3c84b5683e608f43735c803a5f415046686c; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before d87268326b277af3665237ac76a73dd9fa8e21b4; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 87d4954b5c59735a99ea98cb208d47130f6dce7d; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 6d76febba07c40bcf358f63216d36ea68cf1c215; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before 815ddd27c0c7171a99fe802fdb19098ddef8b19d; from d0a22a4b03b8475b7aa3fa41243c26c291407844 before faddeb848305e79db89ee0479bb0e33380656321 | CNA record |
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux | 10.2 | CISA ADP |
Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support redhat:rhel_extras_rt_els | from 0:3.10.0-1160.159.1.rt56.1311.el7 not affected | CISA ADP |
from 0:3.10.0-1160.159.1.el7 not affected | CISA ADP | |
from 0:4.18.0-372.199.1.el8_6 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On redhat:rhel_eus_long_life | from 0:4.18.0-372.199.1.el8_6 not affected | CISA ADP |
from 0:4.18.0-477.159.1.el8_8 not affected | CISA ADP | |
from 0:4.18.0-477.159.1.el8_8 not affected | CISA ADP | |
Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support redhat:rhel_eus | from 0:5.14.0-570.127.1.el9_6 not affected | CISA ADP |
Red Hat Red Hat Enterprise Linux for NVIDIA 26 redhat:enterprise_linux_nvidia | Versions not stated | CISA ADP |
Red Hat Red Hat OpenShift Container Platform 4 redhat:openshift | 4 | CISA ADP |
linux linux_kernel linux:linux_kernel | from 5.2 before 5.10.252; from 5.11 before 5.15.202; from 5.16 before 6.1.165; from 6.2 before 6.6.128; from 6.7 before 6.12.75; from 6.13 before 6.18.14; from 6.19 before 6.19.4 | NVD |
References
- https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442effpatch
- https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142patch
- https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686cpatch
- https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4patch
- https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7dpatch
- https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215patch
- https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19dpatch
- https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321patch
- https://access.redhat.com/errata/RHSA-2026:27789
- https://access.redhat.com/errata/RHSA-2026:33743
- https://access.redhat.com/errata/RHSA-2026:35894
- https://access.redhat.com/errata/RHSA-2026:36049
- https://access.redhat.com/errata/RHSA-2026:36767
- https://access.redhat.com/errata/RHSA-2026:38902
- https://access.redhat.com/errata/RHSA-2026:51603
- https://access.redhat.com/errata/RHSA-2026:51604
- https://access.redhat.com/errata/RHSA-2026:55444
- https://access.redhat.com/errata/RHSA-2026:59142
- https://access.redhat.com/errata/RHSA-2026:59143
- https://access.redhat.com/errata/RHSA-2026:59145
- https://access.redhat.com/errata/RHSA-2026:59146
- https://access.redhat.com/errata/RHSA-2026:59147
- https://access.redhat.com/errata/RHSA-2026:59148
- https://access.redhat.com/errata/RHSA-2026:59149
- https://access.redhat.com/errata/RHSA-2026:61692
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.