{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-45984",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-45984",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-05-27T12:18:42.964Z",
    "updatedAt": "2026-10-19T19:26:41.006Z",
    "importedAt": "2026-10-24T01:58:14.884Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "gfs2: Fix use-after-free in iomap inline data write path",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\ngfs2: Fix use-after-free in iomap inline data write path\n\nThe inline data buffer head (dibh) is being released prematurely in\ngfs2_iomap_begin() via release_metapath() while iomap->inline_data\nstill points to dibh->b_data. This causes a use-after-free when\niomap_write_end_inline() later attempts to write to the inline data\narea.\n\nThe bug sequence:\n1. gfs2_iomap_begin() calls gfs2_meta_inode_buffer() to read inode\n   metadata into dibh\n2. Sets iomap->inline_data = dibh->b_data + sizeof(struct gfs2_dinode)\n3. Calls release_metapath() which calls brelse(dibh), dropping refcount\n   to 0\n4. kswapd reclaims the page (~39ms later in the syzbot report)\n5. iomap_write_end_inline() tries to memcpy() to iomap->inline_data\n6. KASAN detects use-after-free write to freed memory\n\nFix by storing dibh in iomap->private and incrementing its refcount\nwith get_bh() in gfs2_iomap_begin(). The buffer is then properly\nreleased in gfs2_iomap_end() after the inline write completes,\nensuring the page stays alive for the entire iomap operation.\n\nNote: A C reproducer is not available for this issue. The fix is based\non analysis of the KASAN report and code review showing the buffer head\nis freed before use.\n\n[agruenba: Take buffer head reference in gfs2_iomap_begin() to avoid\nleaks in gfs2_iomap_get() and gfs2_iomap_alloc().]",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1403989d1b502f4a2c0d0b42ccf1c25748442eff"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "1cae1bafdf9caa9b462b19af06b1a06902e4e142"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "764c3c84b5683e608f43735c803a5f415046686c"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "d87268326b277af3665237ac76a73dd9fa8e21b4"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "87d4954b5c59735a99ea98cb208d47130f6dce7d"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "6d76febba07c40bcf358f63216d36ea68cf1c215"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "815ddd27c0c7171a99fe802fdb19098ddef8b19d"
            },
            {
              "version": "d0a22a4b03b8475b7aa3fa41243c26c291407844",
              "status": "affected",
              "versionType": "git",
              "lessThan": "faddeb848305e79db89ee0479bb0e33380656321"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "5.2",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "5.2"
            },
            {
              "version": "5.10.252",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.202",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.165",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.128",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.75",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.14",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.4",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}