CVE-2021-45868

What it actually does

Missing validation of on-disk block numbers in fs/quota/quota_tree.c allows a corrupted quota file to trigger a use-after-free in kernel/locking/rwsem.c during quota operations.

Why it matters to the business

Local users on affected Linux systems can trigger kernel crashes or denial of service by supplying a malformed quota file; widespread kernel deployments increase exposure surface until patched.

How an attack unfolds

An attacker with local access supplies or modifies a quota file containing an invalid block number, then triggers quota-related kernel operations that dereference the invalid block, resulting in a use-after-free in the read-write semaphore code.

How to fix it

Upgrade the Linux kernel to version 5.15.3 or later, or apply the commit 9bf3d20331295b1ecb81f4ed9ef358c51699a050 that adds block-number validation in quota_tree.c.

How to confirm the fix worked

Verify the running kernel version is at least 5.15.3; confirm the presence of the validation check in fs/quota/quota_tree.c or the listed commit in the kernel source tree.

Typical attack path

1. Obtain local access or ability to write a quota file
2. Craft or corrupt a quota file with an invalid block number
3. Trigger quota tree operations (e.g., quotaon, filesystem mount with quotas)
4. Cause kernel to follow the invalid block leading to rwsem use-after-free
5. Result in kernel panic or system instability

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages referencing quota_tree.c or rwsem use-after-free around the time of quota operations or filesystem mounts.

What your security team should do

• Prioritize kernel upgrades on all systems that use disk quotas
• Restrict local user ability to supply or modify quota files where possible
• Monitor for kernel oops or panic logs referencing quota_tree or rwsem after any quota operations