CVE-2026-31467

In Linux kernels that use the erofs filesystem, an insufficient‑memory condition can cause the kernel to initiate swap I/O while mapping RAM. The bio completion path, which runs in the process context of services such as dm‑verity, directly calls into decompression and then vm_map_ram(). If vm_map_ram() must perform swapping, submit_bio_wait can deadlock because it blocks waiting for a bio that has already been queued. This kernel deadlock causes the system to become unresponsive, effectively a denial‑of‑service attack. The weakness is a flawed kernel memory allocation path that can result in a deadlock (CWE-667).

All Linux kernel implementations that contain the erofs filesystem are potentially affected, including systems from all major distributions. The vulnerability is present in any kernel version that has not yet incorporated the patch that adds GFP_NOIO to the bio completion path. Devices that use dm‑verity or erofs for integrity checks, such as certain embedded or server systems, fall under the affected umbrella.

The vulnerability is not listed in CISA’s known‑exploited vulnerabilities catalog. The EPSS score of approximately 0.07% indicates a very low likelihood of exploitation, even though it is still within the “< 1%” bucket. The attack still requires a constrained‑memory environment that triggers a swap during the erofs read operation. If such a scenario is achieved, the kernel can deadlock, causing a system‑wide denial of service. The attack vector is inferred to be local; a privileged or local process is needed to trigger the erofs read under low‑memory conditions. Given the severe impact but the very low exploitation probability, the risk remains notable for systems lacking the patch.