CVE-2026-45861
HighCVSS 7.8Exploitation Probability (EPSS)
Low risk5th percentile - higher than 5% of all known CVEs
Summary
A vulnerability was identified in the Linux kernel within the gfs2 filesystem, leading to a use-after-free error due to improper management of quota data objects. This issue occurred during filesystem shutdown when quota objects were removed from the LRU list but not correctly removed from it.
Risk Assessment
This vulnerability may lead to system instability and potential data leakage, posing a threat to the integrity and availability of the filesystem.
Recommendation
It is recommended to update the Linux kernel to the latest version where fixes have been implemented to eliminate this vulnerability. Additionally, systems should be monitored for unauthorized access.
Original NVD description (English source)
In the Linux kernel, the following vulnerability has been resolved: gfs2: Fix slab-use-after-free in qd_put Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously") started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list. Fix this by removing qd objects from the LRU list before freeing them in qd_put(). Initial fix from Deepanshu Kartikey <[email protected]>.