The vulnerability (CVE-2026-45984) in the Linux kernel's GFS2 filesystem involves a use-after-free condition in the iomap inline data write path. Specifically, the inline data buffer head (dibh) is released prematurely in gfs2_iomap_begin() via release_metapath() while iomap->inline_data still points to dibh->b_data. This leads to a use-after-free when iomap_write_end_inline() attempts to write to the inline data area. The fix involves storing dibh in iomap->private and incrementing its reference count with get_bh() to ensure proper release timing. The vulnerability has a CVSS 3.1 score of 7.8 (high severity) with local attack vector, low complexity, low privileges required, and no user interaction. The impact includes potential system instability or denial of service due to memory corruption.

This vulnerability allows a local attacker with low privileges to cause memory corruption by writing to freed memory, potentially leading to system instability or denial of service (DoS). The confidentiality, integrity, and availability of the affected system can be compromised. There are no known exploits in the wild at this time.

An official fix is available and has been released by Red Hat as part of a kernel update for Red Hat Enterprise Linux 9.4. Users should apply the security update (RHSA-2026:36767) and reboot their systems to ensure the patch takes effect. No additional mitigations are required beyond applying the official update.