# CVE-2026-45984

## Summary

- **CVE ID:** CVE-2026-45984
- **Severity:** HIGH
- **CVSS Score:** 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **CWE:** N/A
- **Published:** May 27, 2026
- **Last Modified:** Sep 15, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix use-after-free in iomap inline data write path

The inline data buffer head (dibh) is being released prematurely in
gfs2_iomap_begin() via release_metapath() while iomap->inline_data
still points to dibh->b_data. This causes a use-after-free when
iomap_write_end_inline() later attempts to write to the inline data
area.

The bug sequence:
1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode
   metadata into dibh
2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)
3. Calls release_metapath() which calls brelse(dibh), dropping refcount
   to 0
4. kswapd reclaims the page (~39ms later in the syzbot report)
5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data
6. KASAN detects use-after-free write to freed memory

Fix by storing dibh in iomap->private and incrementing its refcount
with get_bh() in gfs2_iomap_begin(). The buffer is then properly
released in gfs2_iomap_end() after the inline write completes,
ensuring the page stays alive for the entire iomap operation.

Note: A C reproducer is not available for this issue. The fix is based
on analysis of the KASAN report and code review showing the buffer head
is freed before use.

[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid
leaks in gfs2_iomap_get() and gfs2_iomap_alloc().]

## Affected Products

- Linux — Linux (d0a22a4b03b8475b7aa3fa41243c26c291407844)
- Linux — Linux (5.2)
- Linux — Linux (0)
- Linux — Linux (5.10.252)
- Linux — Linux (5.15.202)
- Linux — Linux (6.1.165)
- Linux — Linux (6.6.128)
- Linux — Linux (6.12.75)
- Linux — Linux (6.18.14)
- Linux — Linux (6.19.4)
- Linux — Linux (7.0)

## References

- [CNA](https://git.kernel.org/stable/c/1403989d1b502f4a2c0d0b42ccf1c25748442eff)
- [CNA](https://git.kernel.org/stable/c/1cae1bafdf9caa9b462b19af06b1a06902e4e142)
- [CNA](https://git.kernel.org/stable/c/764c3c84b5683e608f43735c803a5f415046686c)
- [CNA](https://git.kernel.org/stable/c/d87268326b277af3665237ac76a73dd9fa8e21b4)
- [CNA](https://git.kernel.org/stable/c/87d4954b5c59735a99ea98cb208d47130f6dce7d)
- [CNA](https://git.kernel.org/stable/c/6d76febba07c40bcf358f63216d36ea68cf1c215)
- [CNA](https://git.kernel.org/stable/c/815ddd27c0c7171a99fe802fdb19098ddef8b19d)
- [CNA](https://git.kernel.org/stable/c/faddeb848305e79db89ee0479bb0e33380656321)
- [redhat-SADP](https://access.redhat.com/security/cve/CVE-2026-45984)
- [redhat-SADP](https://bugzilla.redhat.com/show_bug.cgi?id=2481922)
- [redhat-SADP](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-45984.json)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:27789)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:33743)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:35894)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36049)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:36767)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:38902)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51603)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:51604)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:55444)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59143)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59146)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59142)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59147)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59145)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59148)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:59149)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:61692)
- [redhat-SADP](https://access.redhat.com/errata/RHSA-2026:63189)

## Exploitation Prediction (EPSS)

- **EPSS Score:** 0.18%
- **EPSS Percentile:** 8.3

---
_Exported from OnDuty AI Vulnerability Intelligence on 2026-09-18._