CVE-2026-31453

xfs: avoid dereferencing log items after push callbacks

Published Apr 22, 2026 CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: avoid dereferencing log items after push callbacks

After xfsaild_push_item() calls iop_push(), the log item may have been
freed if the AIL lock was dropped during the push. Background inode
reclaim or the dquot shrinker can free the log item while the AIL lock
is not held, and the tracepoints in the switch statement dereference
the log item after iop_push() returns.

Fix this by capturing the log item type, flags, and LSN before calling
xfsaild_push_item(), and introducing a new xfs_ail_push_class trace
event class that takes these pre-captured values and the ailp pointer
instead of the log item pointer.

Analysis

Technical impact

An in‑kernel use‑after‑free occurs in the XFS logging path when the background inode reclaim or dquot shrinker frees a log item while the AIL lock is not held. The tracepoints later dereference the freed pointer, which can corrupt kernel memory or cause a kernel crash. The flaw is captured by CWE‑416 (Use‑After‑Free).

Affected Systems

Any Linux kernel build that contains the vulnerable XFS logging code before the patch commits referenced in the provided git logs. Exact version numbers are not supplied in the data, so any kernel earlier than the patch is potentially affected.

Risk and Exploitability

The CVSS score of 7.8 places the vulnerability in the high‑severity range. The EPSS score is reported as less than 1 %, indicating a low but non‑zero probability of exploitation. Because the flaw is triggered by normal filesystem operations that invoke background reclaim or shrinker processes, it can be exercised by users with access to an affected XFS volume. The vulnerability is not listed in the CISA KEV catalog.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< c8a2ab339b88d10fc34a3318c92f07d8a467019d
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 7121b22b0bac89394cc4c6a54b5aebc15347bdf5
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< c4d603e8e58a3bf35480135ccca2b4f7238abda5
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 95fb5d643cc70959baa54cd17f52f80ffc3295e7
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 451c6329d9afa45862c36fe6677eb7750db60617
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 79ef34ec0554ec04bdbafafbc9836423734e1bd6

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

No data.

Vendor Product Versions

Linux

Linux Kernel

Version	Status	Scheme	Platform
`[90c60e16401248a4900f3f9387f563d0178dcf34,c8a2ab339b88d10fc34a3318c92f07d8a467019d)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,7121b22b0bac89394cc4c6a54b5aebc15347bdf5)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,c4d603e8e58a3bf35480135ccca2b4f7238abda5)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,95fb5d643cc70959baa54cd17f52f80ffc3295e7)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,451c6329d9afa45862c36fe6677eb7750db60617)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,79ef34ec0554ec04bdbafafbc9836423734e1bd6)`	affected	code_commit	—

Linux

Linux Kernel

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the XFS logging fix (commit 451c6329d9afa45862c36fe6677eb7750db60617 or newer).
If an immediate kernel upgrade is not possible, isolate critical XFS volumes from demanding workloads and monitor system logs for kernel crashes; no reliable temporary workaround exists.
For custom or older kernel builds, apply the upstream patch manually or request a vendor‑provided patched kernel version.

Generated by OpenCVE AI on October 23, 2026 at 08:11 UTC.

Tracking

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update
Ubuntu USN	USN-8567-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8574-1	Linux kernel (GCP FIPS) vulnerabilities
Ubuntu USN	USN-8574-2	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8596-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8595-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8606-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8607-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8608-1	Linux kernel (Azure FIPS) vulnerabilities
Ubuntu USN	USN-8609-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8574-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8595-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8619-1	Linux kernel (HWE) vulnerabilities
Ubuntu USN	USN-8665-1	Linux kernel (Raspberry Pi) vulnerabilities

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.130% probability within 30 days)

Exploitation none

Automatable no

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617
https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5
https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6
https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7
https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5
https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d
https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31453-6c3f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31453
https://www.cve.org/CVERecord?id=CVE-2026-31453

History

Oct 19, 2026 7:30 PM Weaknesses updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-416

Oct 16, 2026 4:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

May 6, 2026 7:30 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

Apr 27, 2026 2:15 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Apr 23, 2026 12:15 AM Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31453-6c3f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31453 https://www.cve.org/CVERecord?id=CVE-2026-31453
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Apr 22, 2026 2:15 PM Description updated. Title updated. First appearance in the feed. Affected versions updated. Affected vendors updated. Added references View changes

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns. Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer.
Title		xfs: avoid dereferencing log items after push callbacks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617 https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5 https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6 https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7 https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5 https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d