{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-45861", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-13T15:03:33.080Z", "datePublished": "2026-05-27T12:15:41.057Z", "dateUpdated": "2026-08-05T12:28:33.187Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:33.187Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix slab-use-after-free in qd_put\n\nCommit a475c5dd16e5 (\"gfs2: Free quota data objects synchronously\")\nstarted freeing quota data objects during filesystem shutdown instead of\nputting them back onto the LRU list, but it failed to remove these\nobjects from the LRU list, causing LRU list corruption. This caused\nuse-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access\nalready-freed objects on the LRU list.\n\nFix this by removing qd objects from the LRU list before freeing them in\nqd_put().\n\nInitial fix from Deepanshu Kartikey ." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - GFS2 is a local disk filesystem with no network-facing handler; the vulnerable qd lifecycle is reached only via local filesystem operations (mount, quota-incurring I/O, unmount/withdrawal, and the memory shrinker). No remote peer data path exists.\nAC:L - The bug leaves a freed object permanently linked on the global gfs2_qd_lru, so it is persistent rather than a tight race; the attacker can reliably drive the shrinker into the freed object by inducing memory pressure, with no condition outside the attacker's control.\nPR:L - Triggering requires local access to a GFS2 filesystem and the poisoned LRU is then dereferenced by an unprivileged memory-pressure-driven shrinker walk; consistent with clustered-filesystem UAF scoring (ocfs2 CVE-2026-31597/43075).\nUI:N - Once the LRU is corrupted, the use-after-free is reached through ordinary kernel memory reclaim without requiring any separate victim action.\nS:U - The corruption and its impact are confined to the kernel's own memory/security authority; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The shrinker reads fields of the freed gfs2_quota_data object, and the freed slab can be reallocated with attacker-controlled data, enabling kernel memory disclosure typical of a use-after-free.\nI:H - gfs2_qd_isolate writes to the freed object (lockref_mark_dead and list_lru_isolate_move), giving a write primitive over freed/reallocated memory that can be leveraged for heap manipulation and control-flow corruption.\nA:H - The slab-use-after-free reliably corrupts the LRU list and freed memory, causing kernel oops/panic as observed by KASAN/syzbot." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/gfs2/quota.c" ], "versions": [ { "version": "a475c5dd16e57c570113eccba51955b5df8bb052", "lessThan": "ca7c67bdd293089b3483f18886d6b2d0037d2ad9", "status": "affected", "versionType": "git" }, { "version": "a475c5dd16e57c570113eccba51955b5df8bb052", "lessThan": "1d47922b98046b8070a77347fb883a6523792803", "status": "affected", "versionType": "git" }, { "version": "a475c5dd16e57c570113eccba51955b5df8bb052", "lessThan": "80fff26d7a0c3926b511661c27eecc811a420eef", "status": "affected", "versionType": "git" }, { "version": "a475c5dd16e57c570113eccba51955b5df8bb052", "lessThan": "22150a7d401d9e9169b9b68e05bed95f7f49bf69", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/gfs2/quota.c" ], "versions": [ { "version": "6.6", "status": "affected" }, { "version": "0", "lessThan": "6.6", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.75", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.14", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.4", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.12.75" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.18.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "6.19.4" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9" }, { "url": "https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803" }, { "url": "https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef" }, { "url": "https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69" } ], "title": "gfs2: Fix slab-use-after-free in qd_put", "x_generator": { "engine": "bippy-1.2.0" } } } }