REDHAT-BUG-2481922: Use After Free
In the Linux kernel, the following vulnerability has been resolved:
gfs2: Fix use-after-free in iomap inline data write path
The inline data buffer head (dibh) is being released prematurely in gfs2iomapbegin() via releasemetapath() while iomap->inlinedata still points to dibh->bdata. This causes a use-after-free when iomapwriteendinline() later attempts to write to the inline data area.
The bug sequence: 1. gfs2iomapbegin() calls gfs2metainodebuffer() to read inode metadata into dibh 2. Sets iomap->inlinedata = dibh->bdata + sizeof(struct gfs2dinode) 3. Calls releasemetapath() which calls brelse(dibh), dropping refcount to 0 4. kswapd reclaims the page (~39ms later in the syzbot report) 5. iomapwriteendinline() tries to memcpy() to iomap->inlinedata 6. KASAN detects use-after-free write to freed memory
Fix by storing dibh in iomap->private and incrementing its refcount with getbh() in gfs2iomapbegin(). The buffer is then properly released in gfs2iomapend() after the inline write completes, ensuring the page stays alive for the entire iomap operation.
Note: A C reproducer is not available for this issue. The fix is based on analysis of the KASAN report and code review showing the buffer head is freed before use.
[agruenba: Take buffer head reference in gfs2iomapbegin() to avoid leaks in gfs2iomapget() and gfs2iomapalloc().]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify gfs2_iomap_begin() to take/hold a buffer head reference (e.g., via get_bh()) for the inline data write path to prevent premature release/use-after-free. This corresponds to keeping dibh alive instead of releasing it during release_metapath().
gfs2 (Linux kernel) iomap inline data lifetime handling = Take a buffer head reference in gfs2_iomap_begin() (use get_bh()) so the page stays alive for the entire iomap operation - Compensating control
Ensure the system is protected against KASAN-triggered use-after-free by applying the upstream gfs2 fix for the inline data write path (no explicit configuration/workaround is described in the provided text).
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-2481922?
The severity of REDHAT-BUG-2481922 is rated as high with a score of 7.
What does the vulnerability REDHAT-BUG-2481922 affect?
REDHAT-BUG-2481922 affects the Linux kernel, specifically in the gfs2 file system's iomap inline data write path.
How can I mitigate the risk of REDHAT-BUG-2481922?
Mitigation for REDHAT-BUG-2481922 involves updating the Linux kernel to the patched version that fixes the use-after-free vulnerability.
What is the nature of the flaw in REDHAT-BUG-2481922?
The flaw in REDHAT-BUG-2481922 is a use-after-free vulnerability that occurs due to premature release of the inline data buffer head.
When was REDHAT-BUG-2481922 published?
REDHAT-BUG-2481922 was published on May 27, 2026.