Executive brief
A vulnerability was identified in the Linux kernel's GFS2 file system that could lead to system instability or data corruption. The issue occurs when the system prematurely releases memory used for file metadata while it is still being accessed during write operations. An attacker with local access could potentially exploit this to cause a system crash or interfere with data integrity.
Technical details
A use-after-free vulnerability exists in the GFS2 filesystem's iomap inline data write path. In gfs2_iomap_begin(), the inline data buffer head (dibh) is released via release_metapath() while iomap->inline_data still maintains a pointer to dibh->b_data. If the page is reclaimed (e.g., by kswapd) before iomap_write_end_inline() executes its memcpy, a use-after-free write occurs. This was identified via KASAN and syzbot. The fix involves properly incrementing the buffer head refcount with get_bh() and ensuring it is only released in gfs2_iomap_end() after the write operation is complete.
Affected products
- Linux Linux Kernel gfs2 file system component
Timeline
- 2026-05-27: advisory: NVD publication date
- 2026-05-27: patched: Fixes merged into various stable branches
References
- https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff
- https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142
- https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215
- https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c
- https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d
- https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d
- https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4