---
id: CVE-2026-45861
title: 'gfs2: Fix slab-use-after-free in qd_put'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  gfs2: Fix slab-use-after-free in qd_put

  Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
  started freeing quota data objects during filesystem shutdo…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 <
    ca7c67bdd293089b3483f18886d6b2d0037d2ad9
  - >-
    Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 <
    1d47922b98046b8070a77347fb883a6523792803
  - >-
    Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 <
    80fff26d7a0c3926b511661c27eecc811a420eef
  - >-
    Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 <
    22150a7d401d9e9169b9b68e05bed95f7f49bf69
  - Linux 6.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:18:10.745029Z'
published: '2026-05-27'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:45.889Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-45861'
references:
  - url: 'https://git.kernel.org/stable/c/ca7c67bdd293089b3483f18886d6b2d0037d2ad9'
  - url: 'https://git.kernel.org/stable/c/1d47922b98046b8070a77347fb883a6523792803'
  - url: 'https://git.kernel.org/stable/c/80fff26d7a0c3926b511661c27eecc811a420eef'
  - url: 'https://git.kernel.org/stable/c/22150a7d401d9e9169b9b68e05bed95f7f49bf69'
tags:
  - cve.org
epss: 0.00164
epssPercentile: 0.05224
ingestedAt: '2026-10-16T17:24:46.698Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

gfs2: Fix slab-use-after-free in qd_put

Commit a475c5dd16e5 ("gfs2: Free quota data objects synchronously")
started freeing quota data objects during filesystem shutdown instead of
putting them back onto the LRU list, but it failed to remove these
objects from the LRU list, causing LRU list corruption.  This caused
use-after-free when the shrinker (gfs2_qd_shrink_scan) tried to access
already-freed objects on the LRU list.

Fix this by removing qd objects from the LRU list before freeing them in
qd_put().

Initial fix from Deepanshu Kartikey <kartikey406@gmail.com>.

## Affected

- `Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 < ca7c67bdd293089b3483f18886d6b2d0037d2ad9`
- `Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 < 1d47922b98046b8070a77347fb883a6523792803`
- `Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 < 80fff26d7a0c3926b511661c27eecc811a420eef`
- `Linux >= a475c5dd16e57c570113eccba51955b5df8bb052 < 22150a7d401d9e9169b9b68e05bed95f7f49bf69`
- `Linux 6.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.