CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Fix use-after-free in iomap inline data write path
The inline data buffer head (dibh) is being released prematurely in gfs2iomapbegin() via releasemetapath() while iomap->inlinedata still points to dibh->bdata. This causes a use-after-free when iomapwriteendinline() later attempts to write to the inline data area.
The bug sequence: 1. gfs2iomapbegin() calls gfs2metainodebuffer() to read inode metadata into dibh 2. Sets iomap->inlinedata = dibh->bdata + sizeof(struct gfs2dinode) 3. Calls releasemetapath() which calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report) 5. iomapwriteendinline() tries to memcpy() to iomap->inlinedata 6. KASAN detects use-after-free write to freed memory
Fix by storing dibh in iomap->private and incrementing its refcount with getbh() in gfs2iomapbegin(). The buffer is then properly released in gfs2iomapend() after the inline write completes, ensuring the page stays alive for the entire iomap operation.
Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use.
[agruenba: Take buffer head reference in gfs2iomapbegin() to avoid leaks in gfs2iomapget() and gfs2iomapalloc().]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify gfs2_iomap_begin() to take a buffer head reference with get_bh() (per 'Take buffer head reference in gfs2_iomap_begin() to avoid ... ensuring the page stays alive for the entire iomap operation'), preventing premature release of dibh used by iomap->inline_data.
gfs2 (Linux kernel) gfs2_iomap_begin(): iomap inline data buffer head lifetime (use get_bh reference) = Use get_bh() on the buffer head returned by gfs2_meta_inode_buffer() and store it so it is held for the entire iomap operation - Configuration
In the gfs2 iomap inline data write path, set iomap->inline_data to dibh->b_data + sizeof(struct gfs2_dinode) (not a pointer into a dibh that will be released prematurely) and ensure dibh's refcount is incremented/held so the pointer remains valid until iomap_write_end_inline completes.
gfs2 (Linux kernel) iomap->inline_data assignment = iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-45984?
The severity of CVE-2026-45984 is classified as high with a CVSS score of 7.8.
How do I fix CVE-2026-45984?
To fix CVE-2026-45984, upgrade to the patched version of the Linux kernel that addresses the use-after-free vulnerability in gfs2.
What kind of vulnerability is CVE-2026-45984?
CVE-2026-45984 is classified as a Use After Free vulnerability affecting the gfs2 filesystem in the Linux kernel.
Which software is affected by CVE-2026-45984?
CVE-2026-45984 affects the Linux kernel specifically in the gfs2 subsystem.
What are the potential impacts of CVE-2026-45984?
The potential impacts of CVE-2026-45984 include the possibility of system crashes or the execution of arbitrary code due to the use-after-free condition.