CVE-2026-45861: gfs2: Fix slab-use-after-free in qd_put
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Fix slab-use-after-free in qdput
Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2qdshrinkscan) tried to access already-freed objects on the LRU list.
Fix this by removing qd objects from the LRU list before freeing them in qdput().
Initial fix from Deepanshu Kartikey <kartikey406@gmail.com>.
Affected Software
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Linux systems using the GFS2 filesystem are relevant. The vulnerable path involves GFS2 quota-data handling during filesystem shutdown and the GFS2 shrinker.
What access does an attacker need?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
What is the potential impact if exploitation succeeds?
The reported impact includes high confidentiality, integrity, and availability impact. The underlying condition is a use-after-free caused by stale quota-data objects remaining on an LRU list.