Linux Kernel nilfs2 Module Use-After-Free Vulnerability in Buffer Management

A use-after-free vulnerability has been identified in the nilfs2 file system module of the Linux kernel. The issue arises in the function nilfs_lookup_dirty_data_buffers(), which accesses buffers linked to dirty data folios without properly locking the folios. This oversight can lead to use-after-free scenarios, especially when nilfs_clear_folio_dirty() is called asynchronously, such as when the file system becomes read-only. In such cases, the buffers may be freed by try_to_free_buffers() after losing their dirty state, creating a race condition. The vulnerability has been addressed by modifying the locking mechanism in the affected function.

Impact

Exploitation of this vulnerability can lead to use-after-free conditions, potentially allowing for arbitrary code execution or memory corruption.