Bug 2481922 (CVE-2026-45984)

Summary: CVE-2026-45984 kernel: gfs2: Fix use-after-free in iomap inline data write path
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in the Linux kernel's GFS2 filesystem. This memory corruption vulnerability, a use-after-free, occurs in the iomap inline data write path. The issue arises because a data buffer is released prematurely while still being referenced, leading to a write to freed memory. This could allow a local attacker to cause system instability or a denial of service (DoS).
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-05-27 15:02:30 UTC 
In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in iomap inline data write path

The inline data buffer head (dibh) is being released prematurely in
gfs2_iomap_begin() via release_metapath() while iomap->inline_data
still points to dibh->b_data. This causes a use-after-free when
iomap_write_end_inline() later attempts to write to the inline data
area.

The bug sequence:
1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode
   metadata into dibh
2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)
3. Calls release_metapath() which calls brelse(dibh), dropping refcount
   to 0
4. kswapd reclaims the page (~39ms later in the syzbot report)
5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data
6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount
with get_bh() in gfs2_iomap_begin(). The buffer is then properly
released in gfs2_iomap_end() after the inline write completes,
ensuring the page stays alive for the entire iomap operation.

Note: A C reproducer is not available for this issue. The fix is based
on analysis of the KASAN report and code review showing the buffer head
is freed before use.

[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid
leaks in gfs2_iomap_get() and gfs2_iomap_alloc().]
Comment 1 Keith Grant 2026-05-27 22:07:27 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026052739-CVE-2026-45984-107d@gregkh/T
Comment 6 errata-xmlrpc 2026-06-22 08:29:17 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:27789 https://access.redhat.com/errata/RHSA-2026:27789
Comment 7 errata-xmlrpc 2026-06-30 21:17:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:33743 https://access.redhat.com/errata/RHSA-2026:33743
Comment 8 errata-xmlrpc 2026-07-06 13:42:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:35894 https://access.redhat.com/errata/RHSA-2026:35894
Comment 9 errata-xmlrpc 2026-07-07 01:09:39 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:36049 https://access.redhat.com/errata/RHSA-2026:36049
Comment 10 errata-xmlrpc 2026-07-08 14:51:31 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:36767 https://access.redhat.com/errata/RHSA-2026:36767
Comment 11 errata-xmlrpc 2026-07-13 12:50:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:38902 https://access.redhat.com/errata/RHSA-2026:38902
Comment 12 errata-xmlrpc 2026-08-07 17:02:09 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:51604 https://access.redhat.com/errata/RHSA-2026:51604
Comment 13 errata-xmlrpc 2026-08-07 17:02:15 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:51603 https://access.redhat.com/errata/RHSA-2026:51603
Comment 14 errata-xmlrpc 2026-08-17 02:31:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:55444 https://access.redhat.com/errata/RHSA-2026:55444
Comment 15 errata-xmlrpc 2026-08-24 17:41:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:59143 https://access.redhat.com/errata/RHSA-2026:59143
Comment 16 errata-xmlrpc 2026-08-24 17:43:08 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions

Via RHSA-2026:59142 https://access.redhat.com/errata/RHSA-2026:59142
Comment 17 errata-xmlrpc 2026-08-24 17:47:42 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:59147 https://access.redhat.com/errata/RHSA-2026:59147
Comment 18 errata-xmlrpc 2026-08-24 17:52:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:59145 https://access.redhat.com/errata/RHSA-2026:59145
Comment 19 errata-xmlrpc 2026-08-24 17:54:23 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:59148 https://access.redhat.com/errata/RHSA-2026:59148
Comment 20 errata-xmlrpc 2026-08-24 18:07:43 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:59149 https://access.redhat.com/errata/RHSA-2026:59149
Comment 21 errata-xmlrpc 2026-08-24 18:20:03 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:59146 https://access.redhat.com/errata/RHSA-2026:59146
Comment 22 errata-xmlrpc 2026-08-31 16:08:38 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:61692 https://access.redhat.com/errata/RHSA-2026:61692
Comment 23 errata-xmlrpc 2026-09-03 14:31:22 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2026:63189 https://access.redhat.com/errata/RHSA-2026:63189