CVE-2026-45984

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix use-after-free in iomap inline data write path The inline data buffer head (dibh) is being released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This causes a use-after-free when iomap_write_end_inline() later attempts to write to the inline data area. The bug sequence: 1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode metadata into dibh 2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode) 3. Calls release_metapat...

Affected product and versions

Product

Linux Linux, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support

Affected versions

>= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 1403989d1b502f4a2c0d0b42ccf1c25748442eff, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 1cae1bafdf9caa9b462b19af06b1a06902e4e142, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 764c3c84b5683e608f43735c803a5f415046686c, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < d87268326b277af3665237ac76a73dd9fa8e21b4, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 87d4954b5c59735a99ea98cb208d47130f6dce7d, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 6d76febba07c40bcf358f63216d36ea68cf1c215, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < 815ddd27c0c7171a99fe802fdb19098ddef8b19d, >= d0a22a4b03b8475b7aa3fa41243c26c291407844 < faddeb848305e79db89ee0479bb0e33380656321, >= 5.2, >= 5.2 < 5.10.252, >= 5.11 < 5.15.202, >= 5.16 < 6.1.165, >= 6.2 < 6.6.128, >= 6.7 < 6.12.75, >= 6.13 < 6.18.14, >= 6.19 < 6.19.4

Fixed versions

5.10.252, 5.15.202, 6.1.165, 6.6.128, 6.12.75, 6.18.14, 6.19.4

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-416, CWE-826