PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45861 Linux CVE debrief

A use-after-free vulnerability in the Linux kernel's GFS2 (Global File System 2) quota data management code allows memory corruption during filesystem shutdown. The flaw stems from incomplete synchronization between quota data object freeing and LRU list management, introduced in commit a475c5dd16e5. When GFS2 shuts down, quota data objects are freed synchronously but remain on the LRU list; subsequent shrinker scans access these freed objects, triggering slab-use-after-free conditions. The fix ensures proper LRU list removal before object deallocation in qd_put().

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-06-25
Advisory published
2026-05-27
Advisory updated
2026-06-25

Who should care

Organizations running Linux kernels with GFS2 filesystem support enabled, particularly clustered storage environments using GFS2 with quota enforcement. Cloud providers and enterprises with shared storage infrastructure utilizing GFS2 should prioritize assessment.

Technical summary

The vulnerability exists in GFS2's quota data (qd) object lifecycle management. Commit a475c5dd16e5 introduced synchronous freeing of quota data objects during filesystem shutdown to replace LRU list recycling, but omitted the necessary list_del_init() or equivalent removal from the LRU list. This leaves dangling pointers in the LRU list that the gfs2_qd_shrink_scan shrinker subsequently dereferences, accessing freed slab memory. The fix in qd_put() ensures proper list removal before kfree() operations.

Defensive priority

high

Recommended defensive actions

  • Apply kernel updates containing the referenced stable commits when available from your Linux distribution
  • Monitor GFS2 filesystem shutdown operations for unexpected kernel panics or memory corruption indicators
  • Review systems utilizing GFS2 clustered filesystems for kernel version exposure
  • Prioritize patching on systems with heavy quota-enabled GFS2 workloads
  • Consider temporary mitigation by avoiding filesystem shutdown operations during maintenance windows if patching is delayed

Evidence notes

Vulnerability description confirms slab-use-after-free in qd_put() function. Root cause identified as commit a475c5dd16e5 failing to remove quota data objects from LRU list before synchronous freeing. Affects gfs2_qd_shrink_scan shrinker operations. Fix removes qd objects from LRU list prior to freeing. Multiple stable kernel fix commits referenced.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45861 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45861

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45861 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45861

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9

    416baaa9-dc9f-4396-8d5f-8c081fb06d67

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.