CVE-2026-45984: gfs2: Fix use-after-free in iomap inline data write path

Published May 27, 2026
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in iomap inline data write path

The inline data buffer head (dibh) is being released prematurely in gfs2iomapbegin() via releasemetapath() while iomap->inlinedata still points to dibh->bdata. This causes a use-after-free when iomapwriteendinline() later attempts to write to the inline data area.

The bug sequence: 1. gfs2iomapbegin() calls gfs2metainodebuffer() to read inode metadata into dibh 2. Sets iomap->inlinedata = dibh->bdata + sizeof(struct gfs2dinode) 3. Calls releasemetapath() which calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report) 5. iomapwriteendinline() tries to memcpy() to iomap->inlinedata 6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount with getbh() in gfs2iomapbegin(). The buffer is then properly released in gfs2iomapend() after the inline write completes, ensuring the page stays alive for the entire iomap operation.

Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use.

[agruenba: Take buffer head reference in gfs2iomapbegin() to avoid leaks in gfs2iomapget() and gfs2iomapalloc().]

Affected Software

8 affected components
Linux gfs2 (Linux kernel)
Linux Linux kernel>=5.2<5.10.252
Linux Linux kernel>=5.11<5.15.202
Linux Linux kernel>=5.16<6.1.165
Linux Linux kernel>=6.2<6.6.128
Linux Linux kernel>=6.7<6.12.75
Linux Linux kernel>=6.13<6.18.14
Linux Linux kernel>=6.19<6.19.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    Modify gfs2_iomap_begin() to take a buffer head reference with get_bh() (per 'Take buffer head reference in gfs2_iomap_begin() to avoid ... ensuring the page stays alive for the entire iomap operation'), preventing premature release of dibh used by iomap->inline_data.

    gfs2 (Linux kernel) gfs2_iomap_begin(): iomap inline data buffer head lifetime (use get_bh reference) = Use get_bh() on the buffer head returned by gfs2_meta_inode_buffer() and store it so it is held for the entire iomap operation
  2. Configuration

    In the gfs2 iomap inline data write path, set iomap->inline_data to dibh->b_data + sizeof(struct gfs2_dinode) (not a pointer into a dibh that will be released prematurely) and ensure dibh's refcount is incremented/held so the pointer remains valid until iomap_write_end_inline completes.

    gfs2 (Linux kernel) iomap->inline_data assignment = iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)

Event History

May 27, 2026
CVE Published
via MITRE·12:18 PM
Data Sourced
via MITRE·12:18 PM
DescriptionSeverity
Data Sourced
via NVD·02:17 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·03:02 PM
DescriptionSeverityAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2026-45984?

The severity of CVE-2026-45984 is classified as high with a CVSS score of 7.8.

2

How do I fix CVE-2026-45984?

To fix CVE-2026-45984, upgrade to the patched version of the Linux kernel that addresses the use-after-free vulnerability in gfs2.

3

What kind of vulnerability is CVE-2026-45984?

CVE-2026-45984 is classified as a Use After Free vulnerability affecting the gfs2 filesystem in the Linux kernel.

4

Which software is affected by CVE-2026-45984?

CVE-2026-45984 affects the Linux kernel specifically in the gfs2 subsystem.

5

What are the potential impacts of CVE-2026-45984?

The potential impacts of CVE-2026-45984 include the possibility of system crashes or the execution of arbitrary code due to the use-after-free condition.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203