CVE-2016-10905

What it actually does

Use-after-free vulnerability in GFS2 resource group handling triggered by concurrent execution of gfs2_clear_rgrpd and read_rindex_entry in fs/gfs2/rgrp.c.

Why it matters to the business

Local attackers on affected Linux systems can achieve arbitrary code execution or cause kernel crashes, leading to data loss or full system compromise on servers using the GFS2 filesystem.

How an attack unfolds

An attacker with local access crafts filesystem operations that race gfs2_clear_rgrpd and read_rindex_entry, freeing a structure that is later dereferenced to corrupt kernel memory or execute code.

How to fix it

Update the Linux kernel to the version containing commit 36e4ad0316c017d5b271378ed9a1c9a4b77fab5f or later; rebuild and reboot all affected systems.

How to confirm the fix worked

Verify the running kernel contains commit 36e4ad0316c017d5b271378ed9a1c9a4b77fab5f or a backport; inspect fs/gfs2/rgrp.c for the patched gfs2_clear_rgrpd and read_rindex_entry logic.

Typical attack path

1. Obtain local user access on a system mounting GFS2
2. Trigger concurrent rindex operations to induce the use-after-free
3. Leverage the freed object for kernel memory corruption
4. Escalate to root privileges or cause denial of service

How to detect it

Review kernel logs for GFS2 rgrp warnings or oops messages around the time of suspected incidents; audit process activity involving mount or filesystem metadata operations.

What your security team should do

• Prioritize kernel upgrades on all GFS2-using systems within standard change windows
• Monitor upstream stable kernel releases for additional backports
• Restrict local user access on GFS2 hosts until patched