CVE-2026-31467 (GCVE-0-2026-31467)
Vulnerability from cvelistv5
Published
2026-04-22 13:53
Modified
2026-08-05 12:22
Severity ?
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL. Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios. Trimmed down the call stack, as follows: f2fs_submit_read_io submit_bio //bio_list is initialized. mmc_blk_mq_recovery z_erofs_endio vm_map_ram __pte_alloc_kernel __alloc_pages_direct_reclaim shrink_folio_list __swap_writepage submit_bio_wait //bio_list is non-NULL, hang!!! Use memalloc_noio_{save,restore}() to wrap up this path.
References
Impacted products
Vendor Product Version
Linux Linux Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
Version: 648f2de053a882c87c05f0060f47d3b11841fdbe
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d6565ea662e17d45a577184b0011bd69de22dc2b",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "d9d8360cb66e3b599d89d2526e7da8b530ebf2ff",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "378949f46e897204384f3f5f91e42e93e3f87568",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "da40464064599eefe78749f75cd2bba371044c04",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "e83e20b82859f0588e9a52a6fa9fea704a2061cf",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            },
            {
              "lessThan": "c23df30915f83e7257c8625b690a1cece94142a0",
              "status": "affected",
              "version": "648f2de053a882c87c05f0060f47d3b11841fdbe",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/zdata.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.13"
            },
            {
              "lessThan": "5.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n  submit_bio                      //bio_list is initialized.\n    mmc_blk_mq_recovery\n      z_erofs_endio\n        vm_map_ram\n          __pte_alloc_kernel\n            __alloc_pages_direct_reclaim\n              shrink_folio_list\n                __swap_writepage\n                  submit_bio_wait  //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - EROFS is exportable and remote NFS clients can cause kernel VFS reads of exported compressed EROFS files, reaching the same compressed read and bio completion path without local code execution. Scoring the highest reasonable deployment therefore uses Network.\nAC:L - Given a target using compressed EROFS with process-context bio completions such as dm-verity, the attacker can repeatedly issue reads and create memory pressure to drive vm_map_ram() into reclaim. No attacker-uncontrolled race or precise memory layout is required.\nPR:N - In the network-export scenario, an unauthenticated or anonymous read-only NFS client can trigger READ operations that run in kernel nfsd context. EROFS itself adds no privilege gate beyond normal export and file read permissions.\nUI:N - The attacker can trigger the vulnerable path by issuing read requests; no victim user action is required.\nS:U - The deadlock occurs within the kernel filesystem, block I/O, and memory reclaim paths of the same system security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The bug is an allocation-context deadlock caused by reclaim issuing swap I/O while current-\u003ebio_list is active. It does not expose kernel memory or provide a read primitive.\nI:N - The fix only prevents I/O-generating reclaim during decompression, and the vulnerable behavior is a hang rather than memory corruption. There is no data modification or control-flow hijack primitive.\nA:H - The failure mode is a deadlock in submit_bio_wait with bios queued behind an active submit_bio path, which can hang I/O/reclaim and render the system or service unavailable. Kernel deadlocks are high availability impact."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:22:46.421Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d6565ea662e17d45a577184b0011bd69de22dc2b"
        },
        {
          "url": "https://git.kernel.org/stable/c/d9d8360cb66e3b599d89d2526e7da8b530ebf2ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902"
        },
        {
          "url": "https://git.kernel.org/stable/c/378949f46e897204384f3f5f91e42e93e3f87568"
        },
        {
          "url": "https://git.kernel.org/stable/c/da40464064599eefe78749f75cd2bba371044c04"
        },
        {
          "url": "https://git.kernel.org/stable/c/e83e20b82859f0588e9a52a6fa9fea704a2061cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/c23df30915f83e7257c8625b690a1cece94142a0"
        }
      ],
      "title": "erofs: add GFP_NOIO in the bio completion if needed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31467",
    "datePublished": "2026-04-22T13:53:56.910Z",
    "dateReserved": "2026-03-09T15:48:24.097Z",
    "dateUpdated": "2026-08-05T12:22:46.421Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.