CVE-2026-45861 (GCVE-0-2026-45861)
Vulnerability from cvelistv5
Published
2026-05-27 12:15
Modified
2026-08-05 12:28
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey <kartikey406@gmail.com>.
References
Impacted products
Vendor Product Version
Linux Linux Version: a475c5dd16e57c570113eccba51955b5df8bb052
Version: a475c5dd16e57c570113eccba51955b5df8bb052
Version: a475c5dd16e57c570113eccba51955b5df8bb052
Version: a475c5dd16e57c570113eccba51955b5df8bb052
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/quota.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ca7c67bdd293089b3483f18886d6b2d0037d2ad9",
              "status": "affected",
              "version": "a475c5dd16e57c570113eccba51955b5df8bb052",
              "versionType": "git"
            },
            {
              "lessThan": "1d47922b98046b8070a77347fb883a6523792803",
              "status": "affected",
              "version": "a475c5dd16e57c570113eccba51955b5df8bb052",
              "versionType": "git"
            },
            {
              "lessThan": "80fff26d7a0c3926b511661c27eecc811a420eef",
              "status": "affected",
              "version": "a475c5dd16e57c570113eccba51955b5df8bb052",
              "versionType": "git"
            },
            {
              "lessThan": "22150a7d401d9e9169b9b68e05bed95f7f49bf69",
              "status": "affected",
              "version": "a475c5dd16e57c570113eccba51955b5df8bb052",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/gfs2/quota.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.6"
            },
            {
              "lessThan": "6.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.75",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.75",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.14",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.4",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\"gfs2: Free quota data objects synchronously\")\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption.  This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey \u003ckartikey406@gmail.com\u003e."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - GFS2 is a local disk filesystem with no network-facing handler; the vulnerable qd lifecycle is reached only via local filesystem operations (mount, quota-incurring I/O, unmount/withdrawal, and the memory shrinker). No remote peer data path exists.\nAC:L - The bug leaves a freed object permanently linked on the global gfs2_qd_lru, so it is persistent rather than a tight race; the attacker can reliably drive the shrinker into the freed object by inducing memory pressure, with no condition outside the attacker\u0027s control.\nPR:L - Triggering requires local access to a GFS2 filesystem and the poisoned LRU is then dereferenced by an unprivileged memory-pressure-driven shrinker walk; consistent with clustered-filesystem UAF scoring (ocfs2 CVE-2026-31597/43075).\nUI:N - Once the LRU is corrupted, the use-after-free is reached through ordinary kernel memory reclaim without requiring any separate victim action.\nS:U - The corruption and its impact are confined to the kernel\u0027s own memory/security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The shrinker reads fields of the freed gfs2_quota_data object, and the freed slab can be reallocated with attacker-controlled data, enabling kernel memory disclosure typical of a use-after-free.\nI:H - gfs2_qd_isolate writes to the freed object (lockref_mark_dead and list_lru_isolate_move), giving a write primitive over freed/reallocated memory that can be leveraged for heap manipulation and control-flow corruption.\nA:H - The slab-use-after-free reliably corrupts the LRU list and freed memory, causing kernel oops/panic as observed by KASAN/syzbot."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:28:33.187Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9"
        },
        {
          "url": "https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803"
        },
        {
          "url": "https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef"
        },
        {
          "url": "https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69"
        }
      ],
      "title": "gfs2: Fix slab-use-after-free in qd_put",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-45861",
    "datePublished": "2026-05-27T12:15:41.057Z",
    "dateReserved": "2026-05-13T15:03:33.080Z",
    "dateUpdated": "2026-08-05T12:28:33.187Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.