PT-2026-43851 · Linux+2 · Linux Kernel+2
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A use-after-free issue exists in the gfs2 iomap inline data write path. The inline data buffer head
dibh is released prematurely in the gfs2 iomap begin() function via release metapath(), while iomap->inline data still points to dibh->b data. This leads to a use-after-free condition when iomap write end inline() subsequently attempts to write to the inline data area. The process involves gfs2 iomap begin() calling gfs2 meta inode buffer() to read inode metadata into dibh, setting iomap->inline data, and then calling release metapath(), which triggers brelse(dibh) and drops the reference count to zero, allowing the page to be reclaimed before the write operation occurs.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
Use After Free
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Rocky Linux