CVE-2026-45984

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in iomap inline data write path

The inline data buffer head (dibh) is being released prematurely in

gfs2_iomap_begin() via release_metapath() while iomap->inline_data

still points to dibh->b_data. This causes a use-after-free when

iomap_write_end_inline() later attempts to write to the inline data

area.

The bug sequence:

1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode

metadata into dibh

2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)

3. Calls release_metapath() which calls brelse(dibh), dropping refcount

to 0

4. kswapd reclaims the page (~39ms later in the syzbot report)

5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data

6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount

with get_bh() in gfs2_iomap_begin(). The buffer is then properly

released in gfs2_iomap

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References