CVE-2026-45861: Linux Kernel Use-After-Free Vulnerability

CVE-2026-45861 Overview

CVE-2026-45861 is a slab use-after-free vulnerability in the Linux kernel's GFS2 (Global File System 2) quota management code. The flaw resides in the qd_put() function and was introduced by commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously"). That change started freeing quota data objects during filesystem shutdown instead of returning them to the LRU (Least Recently Used) list, but neglected to remove these objects from the LRU list before freeing them. The result is LRU list corruption and a use-after-free when the shrinker gfs2_qd_shrink_scan traverses already-freed quota data objects.

Critical Impact
A local attacker or routine kernel memory pressure event can trigger access to freed slab memory through the GFS2 quota shrinker, leading to kernel memory corruption and potential denial of service or privilege escalation on systems mounting GFS2 filesystems.

Affected Products

Linux kernel versions containing commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
Distributions shipping GFS2 with the affected commit applied
Clustered storage deployments using GFS2 shared filesystems

Discovery Timeline

2026-05-27 - CVE-2026-45861 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45861

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] in the GFS2 quota subsystem. GFS2 tracks per-user and per-group quota information through gfs2_quota_data objects, which are cached on an LRU list and reclaimed by the shrinker gfs2_qd_shrink_scan under memory pressure. During filesystem shutdown, qd_put() releases these objects.

The earlier commit a475c5dd16e5 changed shutdown semantics so quota data objects are freed synchronously rather than returned to the LRU list. However, the patch did not call the LRU removal helper before freeing the slab object. Stale pointers to freed gfs2_quota_data structures therefore remain linked on the global LRU list.

When the kernel later invokes the shrinker to reclaim memory, it walks the LRU list and dereferences pointers to slab memory that has already been returned to the allocator. This produces a slab-use-after-free condition detectable by KASAN and can corrupt adjacent slab objects.

Root Cause

The root cause is missing LRU list maintenance in the shutdown free path. Quota data objects must be unlinked from the LRU list before their backing memory is released. The fix removes qd objects from the LRU list inside qd_put() prior to freeing, restoring the list invariant that all linked entries point to valid allocations.

Attack Vector

Exploitation requires local interaction with a GFS2-mounted filesystem during or near shutdown, combined with memory pressure sufficient to invoke gfs2_qd_shrink_scan. An attacker with the ability to mount or unmount GFS2 volumes, or to influence quota activity on a shared cluster filesystem, can race shutdown against the shrinker to trigger the use-after-free. Successful exploitation may result in kernel panic, memory corruption, or escalation primitives depending on slab reuse patterns. The initial fix was attributed to Deepanshu Kartikey.

No public exploit is available, and the EPSS probability is low. See the upstream commits for the technical fix: Kernel Git Commit 1d47922b, Kernel Git Commit 22150a7d, Kernel Git Commit 80fff26d, and Kernel Git Commit ca7c67bd.

Detection Methods for CVE-2026-45861

Indicators of Compromise

KASAN reports flagging slab-use-after-free in qd_put or gfs2_qd_shrink_scan call paths
Kernel oops or panic traces referencing gfs2_quota_data, qd_put, or list_lru corruption
Unexpected kernel crashes during GFS2 unmount operations under memory pressure

Detection Strategies

Enable KASAN on test kernels to surface use-after-free conditions in the GFS2 quota path
Audit running kernel versions against the patched commits to identify exposed hosts
Collect and correlate dmesg output containing gfs2:, qd_put, or list_lru warnings across the fleet

Monitoring Recommendations

Forward kernel logs to a centralized telemetry pipeline and alert on GFS2-related oops or KASAN signatures
Monitor mount, unmount, and quota activity on clustered GFS2 deployments for anomalous patterns
Track kernel package versions across Linux hosts to confirm patch deployment status

How to Mitigate CVE-2026-45861

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits and rebuild or update affected kernels
Identify all systems with GFS2 mounts and prioritize them for patching, particularly clustered storage nodes
Restrict mount and unmount privileges to trusted administrators while patching is in progress

Patch Information

The fix removes qd objects from the LRU list before freeing them in qd_put(). It is available in the following upstream commits: Kernel Git Commit 1d47922b, Kernel Git Commit 22150a7d, Kernel Git Commit 80fff26d, and Kernel Git Commit ca7c67bd. Apply the corresponding distribution kernel update once published by your vendor.

Workarounds

Avoid using GFS2 quotas on unpatched kernels where alternative filesystems are acceptable
Reduce memory pressure on GFS2 hosts to lower the likelihood of shrinker invocation against stale LRU entries
Schedule controlled unmounts during low-load windows and avoid concurrent quota operations during shutdown

bash

# Verify the running kernel version and check for GFS2 mounts
uname -r
mount -t gfs2

# Inspect kernel ring buffer for GFS2 quota or KASAN warnings
dmesg | grep -E 'gfs2|qd_put|slab-use-after-free|list_lru'