{"id":"CVE-2026-45984","revision":"7084e600232249a9a52c066b0171f237","records":[{"revision":"7084e600232249a9a52c066b0171f237","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-45984","aliases":[],"title":"gfs2: Fix use-after-free in iomap inline data write path","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap->inline_data\nstill points to dibh->b_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n   metadata into dibh\n2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n   to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap->private and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().]","state":0,"publishedAt":"2026-05-27T12:18:42.964+00:00","modifiedAt":"2026-10-19T19:26:41.006+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/gfs2/bmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"1403989d1b502f4a2c0d0b42ccf1c25748442eff\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"1cae1bafdf9caa9b462b19af06b1a06902e4e142\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"764c3c84b5683e608f43735c803a5f415046686c\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"d87268326b277af3665237ac76a73dd9fa8e21b4\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"87d4954b5c59735a99ea98cb208d47130f6dce7d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"6d76febba07c40bcf358f63216d36ea68cf1c215\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"815ddd27c0c7171a99fe802fdb19098ddef8b19d\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d0a22a4b03b8475b7aa3fa41243c26c291407844\",\n                            \"lessThan\": \"faddeb848305e79db89ee0479bb0e33380656321\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"fs/gfs2/bmap.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"5.2\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"5.2\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.10.252\",\n                            \"lessThanOrEqual\": \"5.10.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"5.15.202\",\n                            \"lessThanOrEqual\": \"5.15.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.1.165\",\n                            \"lessThanOrEqual\": \"6.1.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.128\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.75\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.14\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.4\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff","https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142","https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c","https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4","https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d","https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215","https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d","https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-45984","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-45984","identifiers":["CVE-2026-45984"]},"retained":false,"historicalAffected":[]}],"coverage":[]}