CVE-2026-45861

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix slab-use-after-free in qd_put

Commit a475c5dd16e5 (gfs2: Free quota data objects synchronously) started freeing quota data objects during filesystem shutdown instead of putting them back onto the LRU list, but it failed to remove these objects from the LRU list, causing LRU list corruption. This caused use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access already-freed objects on the LRU list.

Fix this by removing qd objects from the LRU list before freeing them in qd_put().

Initial fix from Deepanshu Kartikey kartikey406@gmail.com.

Weakness

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory “belongs” to the code that operates on the new pointer.

Affected Software

Potential Mitigations

References

• https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803
• https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69
• https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef
• https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9