CVE-2026-31597 (GCVE-0-2026-31597)
Vulnerability from cvelistv5
Published
2026-04-24 14:42
Modified
2026-08-05 12:23
Severity ?
7.8 (High) - CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Summary
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward.
References
Impacted products
Vendor Product Version
Linux Linux Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
Version: 614a9e849ca6ea24843795251cb30af525d5336b
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/mmap.c",
            "fs/ocfs2/ocfs2_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "36539c4d536f851a3b346a6ebb27b51bc3d77a94",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "35c2c05261d6f6d84aaa1355afa201d507943e76",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "3f5e74b5db9353b01ed50f4de84e75b755f8fbc2",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "6f072daefcab1d84ce37c073645615f63be91006",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "4cf2768a0291a0cdd0dae801ea0eafa3878a349d",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "d45ff441b416d4aa1af72b1db23d959601c04da2",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "76a602fdbb78dd05b2da06f74a988cebc97e82d0",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "925bf22c1b823e231b1baea761fe8a1512e442f2",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            },
            {
              "lessThan": "7de554cabf160e331e4442e2a9ad874ca9875921",
              "status": "affected",
              "version": "614a9e849ca6ea24843795251cb30af525d5336b",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/ocfs2/mmap.c",
            "fs/ocfs2/ocfs2_trace.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.39"
            },
            {
              "lessThan": "2.6.39",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.136",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.83",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.24",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.258",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.209",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.175",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.136",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.83",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.24",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "2.6.39",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY\n\nfilemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY,\nas documented in mm/filemap.c:\n\n  \"If our return value has VM_FAULT_RETRY set, it\u0027s because the mmap_lock\n  may be dropped before doing I/O or by lock_folio_maybe_drop_mmap().\"\n\nWhen this happens, a concurrent munmap() can call remove_vma() and free\nthe vm_area_struct via RCU. The saved \u0027vma\u0027 pointer in ocfs2_fault() then\nbecomes a dangling pointer, and the subsequent trace_ocfs2_fault() call\ndereferences it -- a use-after-free.\n\nFix this by saving ip_blkno as a plain integer before calling\nfilemap_fault(), and removing vma from the trace event. Since\nip_blkno is copied by value before the lock can be dropped, it\nremains valid regardless of what happens to the vma or inode\nafterward."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached by local user memory-management operations on an OCFS2 regular file mapping, via mmap/page fault and concurrent unmap. It is not directly reachable from network packets or adjacent/physical interfaces.\nAC:L - The attacker can control the relevant mmap, page fault, and munmap activity from their own process or cooperating threads. The VM_FAULT_RETRY window is a normal retry path where filemap_fault() may drop mmap_lock, so the race is attacker-repeatable.\nPR:L - A basic local user with permission to open and mmap a file on an already-mounted OCFS2 filesystem can reach ocfs2_fault(); no kernel capability is needed for the fault/unmap path. Mounting OCFS2 itself is privileged, but a reasonable OCFS2 deployment already has the filesystem mounted.\nUI:N - Exploitation does not require a separate victim action after the attacker has local access. The attacker triggers the mmap, page fault, and munmap operations directly.\nS:U - The vulnerability is in kernel filesystem/MM handling and impacts the same kernel security authority. This is standard local kernel compromise/DoS territory, not a cross-scope VM or sandbox boundary by itself.\nC:H - This is a kernel heap use-after-free of a vm_area_struct after mmap_lock can be dropped and the VMA freed. Under the stated kernel guidance, use-after-free bugs are scored High for confidentiality because freed object reuse can enable kernel memory disclosure.\nI:H - Although the observed KASAN report is a UAF read, it is still a dangling kernel heap object use in attacker-influenced VMA lifetime/reuse conditions. Under the stated guidance and uncertainty rule, UAF memory corruption is scored High for integrity.\nA:H - The bug has a demonstrated KASAN slab-use-after-free in ocfs2_fault() and can crash/oops the kernel. Kernel crash availability impact is High."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:41.347Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94"
        },
        {
          "url": "https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76"
        },
        {
          "url": "https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2"
        },
        {
          "url": "https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006"
        },
        {
          "url": "https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d"
        },
        {
          "url": "https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2"
        },
        {
          "url": "https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2"
        },
        {
          "url": "https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921"
        }
      ],
      "title": "ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31597",
    "datePublished": "2026-04-24T14:42:22.655Z",
    "dateReserved": "2026-03-09T15:48:24.121Z",
    "dateUpdated": "2026-08-05T12:23:41.347Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.