The Linux kernel contains a slab-use-after-free bug in the GFS2 filesystem’s quota data handling. The flaw occurs when the qd_put() routine removes quota data objects from the LRU list without fully unlinking them, leading to LRU list corruption. During a filesystem shutdown, the shrinker gfs2_qd_shrink_scan may later attempt to access these freed objects, causing a use-after‑free that can result in arbitrary kernel memory corruption or execution of arbitrary code. If exploited, an attacker could gain root privileges on the affected system.

The vulnerability affects any Linux kernel that includes the GFS2 filesystem and does not yet contain the fix found in commit a475c5dd16e5. This includes a wide range of distributions that ship their own kernel builds, as well as systems compiled from source without the patch. The vendor list indicates Linux:Linux for the affected product. Without explicit version bounds, any kernel version prior to the hotfix is potentially susceptible.

Because CVSS and EPSS metrics are not available, the precise exploitation probability is unknown. The bug manifests during a filesystem shutdown and may require local access or a crafted GFS2 volume to trigger, but kernel memory corruption could ultimately enable arbitrary code execution and privilege escalation. The vulnerability is not listed in the CISA KEV catalog, and no public exploit is known, yet the risk of local elevation remains high and should be addressed promptly.