CVE-2026-31453 - Vulnerability Details

- xfs: avoid dereferencing log items after push callbacks

Description

In the Linux kernel, the following vulnerability has been resolved:

xfs: avoid dereferencing log items after push callbacks

After xfsaild_push_item() calls iop_push(), the log item may have been
freed if the AIL lock was dropped during the push. Background inode
reclaim or the dquot shrinker can free the log item while the AIL lock
is not held, and the tracepoints in the switch statement dereference
the log item after iop_push() returns.

Fix this by capturing the log item type, flags, and LSN before calling
xfsaild_push_item(), and introducing a new xfs_ail_push_class trace
event class that takes these pre-captured values and the ailp pointer
instead of the log item pointer.

Published: 2026-04-22

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

An in‑kernel use‑after‑free occurs in the XFS logging path when the background inode reclaim or dquot shrinker frees a log item while the AIL lock is not held. The tracepoints later dereference the freed pointer, which can corrupt kernel memory or cause a kernel crash. The flaw is captured by CWE‑476 (Use‑After‑Free) and CWE‑825 (Improper Verification of Logical Conditions).

Affected Systems

Any Linux kernel build that contains the vulnerable XFS logging code before the commit referenced in the provided git log identifiers. Exact version numbers are not supplied in the data, so any kernel earlier than the patch commits is potentially affected.

Risk and Exploitability

The CVSS score of 7.8 places the vulnerability in the high‑severity range. The EPSS score is reported as less than 1 %, indicating a low but non‑zero probability of exploitation. Because the flaw is triggered by normal filesystem operations that invoke background reclaim or shrinker processes, it can be exercised by users with access to an affected XFS volume. The vulnerability is not listed in the CISA KEV catalog.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< c8a2ab339b88d10fc34a3318c92f07d8a467019d
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 7121b22b0bac89394cc4c6a54b5aebc15347bdf5
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< c4d603e8e58a3bf35480135ccca2b4f7238abda5
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 95fb5d643cc70959baa54cd17f52f80ffc3295e7
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 451c6329d9afa45862c36fe6677eb7750db60617
`90c60e16401248a4900f3f9387f563d0178dcf34`	affected	< 79ef34ec0554ec04bdbafafbc9836423734e1bd6

Linux

affected

Version	Status	Constraints
`5.9`	affected	—
`0`	unaffected	< 5.9
`6.1.168`	unaffected	≤ 6.1.*
`6.6.131`	unaffected	≤ 6.6.*
`6.12.80`	unaffected	≤ 6.12.*
`6.18.21`	unaffected	≤ 6.18.*
`6.19.11`	unaffected	≤ 6.19.*
`7.0`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[90c60e16401248a4900f3f9387f563d0178dcf34,c8a2ab339b88d10fc34a3318c92f07d8a467019d)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,7121b22b0bac89394cc4c6a54b5aebc15347bdf5)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,c4d603e8e58a3bf35480135ccca2b4f7238abda5)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,95fb5d643cc70959baa54cd17f52f80ffc3295e7)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,451c6329d9afa45862c36fe6677eb7750db60617)`	affected	code_commit	—
`[90c60e16401248a4900f3f9387f563d0178dcf34,79ef34ec0554ec04bdbafafbc9836423734e1bd6)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.9`	affected	generic	—
`[0,5.9)`	unaffected	generic	—
`[6.1.168,6.2.0)`	unaffected	semver	—
`[6.6.131,6.7.0)`	unaffected	semver	—
`[6.12.80,6.13.0)`	unaffected	semver	—
`[6.18.21,6.19.0)`	unaffected	semver	—
`[6.19.11,6.20.0)`	unaffected	semver	—
`[7.0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a version that includes the XFS logging fix (commit 451c6329d9afa45862c36fe6677eb7750db60617 or newer).
If an immediate kernel upgrade is not possible, isolate critical XFS volumes from demanding workloads and monitor system logs for kernel crashes; no reliable temporary workaround exists.
For custom or older kernel builds, apply the upstream patch manually or request a vendor‑provided patched kernel version.

Generated by OpenCVE AI on May 6, 2026 at 21:13 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4561-1	linux-6.1 security update
Debian DSA	DSA-6238-1	linux security update
Debian DSA	DSA-6243-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617
https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5
https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6
https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7
https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5
https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d
https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31453-6c3f@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-31453
https://www.cve.org/CVERecord?id=CVE-2026-31453

History

Wed, 06 May 2026 19:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-476
CPEs		cpe:2.3:o:linux:linux_kernel:7.0:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

Mon, 27 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Thu, 23 Apr 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026042248-CVE-2026-31453-6c3f@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-31453 https://www.cve.org/CVERecord?id=CVE-2026-31453
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Wed, 22 Apr 2026 14:15:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: xfs: avoid dereferencing log items after push callbacks After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns. Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer.
Title		xfs: avoid dereferencing log items after push callbacks
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/451c6329d9afa45862c36fe6677eb7750db60617 https://git.kernel.org/stable/c/7121b22b0bac89394cc4c6a54b5aebc15347bdf5 https://git.kernel.org/stable/c/79ef34ec0554ec04bdbafafbc9836423734e1bd6 https://git.kernel.org/stable/c/95fb5d643cc70959baa54cd17f52f80ffc3295e7 https://git.kernel.org/stable/c/c4d603e8e58a3bf35480135ccca2b4f7238abda5 https://git.kernel.org/stable/c/c8a2ab339b88d10fc34a3318c92f07d8a467019d

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-04-22T13:53:47.577Z

Updated: 2026-05-11T22:09:00.290Z

Reserved: 2026-03-09T15:48:24.091Z

Link: CVE-2026-31453

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-04-22T14:16:39.653

Modified: 2026-05-06T19:17:21.167

Link: CVE-2026-31453

Redhat

Severity : Moderate

Publid Date: 2026-04-22T00:00:00Z

Links: CVE-2026-31453 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-06T21:15:13Z

Weaknesses

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object