CVE-2026-23224 (GCVE-0-2026-23224)

Vulnerability from cvelistv5 – Published: 2026-02-18 14:53 – Updated: 2026-08-05 12:20
VLAI
Title
erofs: fix UAF issue for file-backed mounts w/ directio option
Summary
In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222] do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222] do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio - erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw : bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). - file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference count, the last one decreasing the reference count to zero will free rq.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: fb176750266a3d7f42ebdcf28e8ba40350b27847 , < ae385826840a3c8e09bf38cac90adcd690716f57 (git)
Affected: fb176750266a3d7f42ebdcf28e8ba40350b27847 , < d741534302f71c511eb0bb670b92eaa7df4a0aec (git)
Affected: fb176750266a3d7f42ebdcf28e8ba40350b27847 , < b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa (git)
Affected: fb176750266a3d7f42ebdcf28e8ba40350b27847 , < 1caf50ce4af096d0280d59a31abdd85703cd995c (git)
Create a notification for this product.
Linux Linux Affected: 6.12
Unaffected: 0 , < 6.12 (semver)
Unaffected: 6.12.72 , ≤ 6.12.* (semver)
Unaffected: 6.18.11 , ≤ 6.18.* (semver)
Unaffected: 6.19.1 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/fileio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ae385826840a3c8e09bf38cac90adcd690716f57",
              "status": "affected",
              "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847",
              "versionType": "git"
            },
            {
              "lessThan": "d741534302f71c511eb0bb670b92eaa7df4a0aec",
              "status": "affected",
              "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847",
              "versionType": "git"
            },
            {
              "lessThan": "b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa",
              "status": "affected",
              "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847",
              "versionType": "git"
            },
            {
              "lessThan": "1caf50ce4af096d0280d59a31abdd85703cd995c",
              "status": "affected",
              "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/erofs/fileio.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.12"
            },
            {
              "lessThan": "6.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.72",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.72",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.11",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.1",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "6.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix UAF issue for file-backed mounts w/ directio option\n\n[    9.269940][ T3222] Call trace:\n[    9.269948][ T3222]  ext4_file_read_iter+0xac/0x108\n[    9.269979][ T3222]  vfs_iocb_iter_read+0xac/0x198\n[    9.269993][ T3222]  erofs_fileio_rq_submit+0x12c/0x180\n[    9.270008][ T3222]  erofs_fileio_submit_bio+0x14/0x24\n[    9.270030][ T3222]  z_erofs_runqueue+0x834/0x8ac\n[    9.270054][ T3222]  z_erofs_read_folio+0x120/0x220\n[    9.270083][ T3222]  filemap_read_folio+0x60/0x120\n[    9.270102][ T3222]  filemap_fault+0xcac/0x1060\n[    9.270119][ T3222]  do_pte_missing+0x2d8/0x1554\n[    9.270131][ T3222]  handle_mm_fault+0x5ec/0x70c\n[    9.270142][ T3222]  do_page_fault+0x178/0x88c\n[    9.270167][ T3222]  do_translation_fault+0x38/0x54\n[    9.270183][ T3222]  do_mem_abort+0x54/0xac\n[    9.270208][ T3222]  el0_da+0x44/0x7c\n[    9.270227][ T3222]  el0t_64_sync_handler+0x5c/0xf4\n[    9.270253][ T3222]  el0t_64_sync+0x1bc/0x1c0\n\nEROFS may encounter above panic when enabling file-backed mount w/\ndirectio mount option, the root cause is it may suffer UAF in below\nrace condition:\n\n- z_erofs_read_folio                          wq s_dio_done_wq\n - z_erofs_runqueue\n  - erofs_fileio_submit_bio\n   - erofs_fileio_rq_submit\n    - vfs_iocb_iter_read\n     - ext4_file_read_iter\n      - ext4_dio_read_iter\n       - iomap_dio_rw\n       : bio was submitted and return -EIOCBQUEUED\n                                              - dio_aio_complete_work\n                                               - dio_complete\n                                                - dio-\u003eiocb-\u003eki_complete (erofs_fileio_ki_complete())\n                                                 - kfree(rq)\n                                                 : it frees iocb, iocb.ki_filp can be UAF in file_accessed().\n       - file_accessed\n       : access NULL file point\n\nIntroduce a reference count in struct erofs_fileio_rq, and initialize it\nas two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will\ndecrease reference count, the last one decreasing the reference count\nto zero will free rq."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is triggered by reading a file on a locally mounted EROFS filesystem. No network vector is involved; the attacker needs local access to read files on the mount.\nAC:L - The race condition is deterministic \u2014 whenever the backing file\u0027s DIO returns -EIOCBQUEUED (the normal async case), the completion handler frees the rq before the submission path finishes using it. The attacker simply reads a file; no special timing or conditions are needed beyond the directio mount configuration.\nPR:L - While mounting EROFS with directio requires root, once mounted any unprivileged user who can read files on the filesystem triggers the UAF. In deployment scenarios like Android or containers where EROFS is commonly used, unprivileged processes regularly access EROFS-mounted files.\nUI:N - No user interaction is required at attack time. The attacker simply reads a file on the EROFS mount; no victim needs to perform any action.\nS:U - The vulnerability and impact remain within the kernel\u0027s security authority. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\nC:H - This is a use-after-free on a heap-allocated structure. An attacker can potentially reclaim the freed memory via heap spraying to read arbitrary kernel memory through the stale pointer dereference, providing information disclosure.\nI:H - The UAF on the heap-allocated erofs_fileio_rq structure enables heap spraying to place attacker-controlled data in the freed slot, potentially achieving arbitrary write primitives and code execution through control flow hijacking.\nA:H - The UAF causes an immediate kernel crash/oops when accessing the freed rq-\u003eiocb.ki_filp pointer, as shown in the commit\u0027s call trace. Any file read on the affected mount reliably triggers a kernel panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:20:42.343Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ae385826840a3c8e09bf38cac90adcd690716f57"
        },
        {
          "url": "https://git.kernel.org/stable/c/d741534302f71c511eb0bb670b92eaa7df4a0aec"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa"
        },
        {
          "url": "https://git.kernel.org/stable/c/1caf50ce4af096d0280d59a31abdd85703cd995c"
        }
      ],
      "title": "erofs: fix UAF issue for file-backed mounts w/ directio option",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-23224",
    "datePublished": "2026-02-18T14:53:27.462Z",
    "dateReserved": "2026-01-13T15:37:45.987Z",
    "dateUpdated": "2026-08-05T12:20:42.343Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-23224",
      "date": "2026-08-15",
      "epss": "0.00124",
      "percentile": "0.02564"
    },
    "microsoft_vex": {
      "current_release_date": "2026-03-03T01:37:50.000Z",
      "cve": "CVE-2026-23224",
      "id": "msrc_CVE-2026-23224",
      "initial_release_date": "2026-02-02T00:00:00.000Z",
      "product_status:known_not_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "erofs: fix UAF issue for file-backed mounts w/ directio option",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-23224.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-23224\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-02-18T16:22:32.143\",\"lastModified\":\"2026-06-17T10:21:08.060\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nerofs: fix UAF issue for file-backed mounts w/ directio option\\n\\n[    9.269940][ T3222] Call trace:\\n[    9.269948][ T3222]  ext4_file_read_iter+0xac/0x108\\n[    9.269979][ T3222]  vfs_iocb_iter_read+0xac/0x198\\n[    9.269993][ T3222]  erofs_fileio_rq_submit+0x12c/0x180\\n[    9.270008][ T3222]  erofs_fileio_submit_bio+0x14/0x24\\n[    9.270030][ T3222]  z_erofs_runqueue+0x834/0x8ac\\n[    9.270054][ T3222]  z_erofs_read_folio+0x120/0x220\\n[    9.270083][ T3222]  filemap_read_folio+0x60/0x120\\n[    9.270102][ T3222]  filemap_fault+0xcac/0x1060\\n[    9.270119][ T3222]  do_pte_missing+0x2d8/0x1554\\n[    9.270131][ T3222]  handle_mm_fault+0x5ec/0x70c\\n[    9.270142][ T3222]  do_page_fault+0x178/0x88c\\n[    9.270167][ T3222]  do_translation_fault+0x38/0x54\\n[    9.270183][ T3222]  do_mem_abort+0x54/0xac\\n[    9.270208][ T3222]  el0_da+0x44/0x7c\\n[    9.270227][ T3222]  el0t_64_sync_handler+0x5c/0xf4\\n[    9.270253][ T3222]  el0t_64_sync+0x1bc/0x1c0\\n\\nEROFS may encounter above panic when enabling file-backed mount w/\\ndirectio mount option, the root cause is it may suffer UAF in below\\nrace condition:\\n\\n- z_erofs_read_folio                          wq s_dio_done_wq\\n - z_erofs_runqueue\\n  - erofs_fileio_submit_bio\\n   - erofs_fileio_rq_submit\\n    - vfs_iocb_iter_read\\n     - ext4_file_read_iter\\n      - ext4_dio_read_iter\\n       - iomap_dio_rw\\n       : bio was submitted and return -EIOCBQUEUED\\n                                              - dio_aio_complete_work\\n                                               - dio_complete\\n                                                - dio-\u003eiocb-\u003eki_complete (erofs_fileio_ki_complete())\\n                                                 - kfree(rq)\\n                                                 : it frees iocb, iocb.ki_filp can be UAF in file_accessed().\\n       - file_accessed\\n       : access NULL file point\\n\\nIntroduce a reference count in struct erofs_fileio_rq, and initialize it\\nas two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will\\ndecrease reference count, the last one decreasing the reference count\\nto zero will free rq.\"},{\"lang\":\"es\",\"value\":\"Se ha resuelto la siguiente vulnerabilidad en el kernel de Linux:\\n\\nerofs: soluciona un problema de UAF para montajes respaldados por archivos con la opci\u00f3n \u0027directio\u0027\\n\\n[    9.269940][ T3222] Rastreo de llamadas:\\n[    9.269948][ T3222]  ext4_file_read_iter+0xac/0x108\\n[    9.269979][ T3222]  vfs_iocb_iter_read+0xac/0x198\\n[    9.269993][ T3222]  erofs_fileio_rq_submit+0x12c/0x180\\n[    9.270008][ T3222]  erofs_fileio_submit_bio+0x14/0x24\\n[    9.270030][ T3222]  z_erofs_runqueue+0x834/0x8ac\\n[    9.270054][ T3222]  z_erofs_read_folio+0x120/0x220\\n[    9.270083][ T3222]  filemap_read_folio+0x60/0x120\\n[    9.270102][ T3222]  filemap_fault+0xcac/0x1060\\n[    9.270119][ T3222]  do_pte_missing+0x2d8/0x1554\\n[    9.270131][ T3222]  handle_mm_fault+0x5ec/0x70c\\n[    9.270142][ T3222]  do_page_fault+0x178/0x88c\\n[    9.270167][ T3222]  do_translation_fault+0x38/0x54\\n[    9.270183][ T3222]  do_mem_abort+0x54/0xac\\n[    9.270208][ T3222]  el0_da+0x44/0x7c\\n[    9.270227][ T3222]  el0t_64_sync_handler+0x5c/0xf4\\n[    9.270253][ T3222]  el0t_64_sync+0x1bc/0x1c0\\n\\nEROFS puede encontrar el p\u00e1nico anterior al habilitar el montaje respaldado por archivos con la opci\u00f3n de montaje directio; la causa ra\u00edz es que puede sufrir UAF en la siguiente condici\u00f3n de carrera:\\n\\n- z_erofs_read_folio                          wq s_dio_done_wq\\n - z_erofs_runqueue\\n  - erofs_fileio_submit_bio\\n   - erofs_fileio_rq_submit\\n    - vfs_iocb_iter_read\\n     - ext4_file_read_iter\\n      - ext4_dio_read_iter\\n       - iomap_dio_rw\\n       : bio fue enviado y devuelve -EIOCBQUEUED\\n                                              - dio_aio_complete_work\\n                                               - dio_complete\\n                                                - dio-\u0026gt;iocb-\u0026gt;ki_complete (erofs_fileio_ki_complete())\\n                                                 - kfree(rq)\\n                                                 : libera iocb, iocb.ki_filp puede ser UAF en file_accessed().\\n       - file_accessed\\n       : accede a un puntero de archivo NULL\\n\\nIntroducir un contador de referencias en la estructura erofs_fileio_rq, y lo inicializa a dos; tanto erofs_fileio_ki_complete() como erofs_fileio_rq_submit() disminuir\u00e1n el contador de referencias, el \u00faltimo en disminuir el contador de referencias a cero liberar\u00e1 rq.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/erofs/fileio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"fb176750266a3d7f42ebdcf28e8ba40350b27847\",\"lessThan\":\"ae385826840a3c8e09bf38cac90adcd690716f57\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb176750266a3d7f42ebdcf28e8ba40350b27847\",\"lessThan\":\"d741534302f71c511eb0bb670b92eaa7df4a0aec\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb176750266a3d7f42ebdcf28e8ba40350b27847\",\"lessThan\":\"b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"fb176750266a3d7f42ebdcf28e8ba40350b27847\",\"lessThan\":\"1caf50ce4af096d0280d59a31abdd85703cd995c\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/erofs/fileio.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.72\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.11\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.1\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-416\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.12\",\"versionEndExcluding\":\"6.12.72\",\"matchCriteriaId\":\"6A704C39-CE3C-408D-9CE6-55B0E4AFCE28\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.11\",\"matchCriteriaId\":\"7099A9EC-3D54-4424-BF01-7224EF88C79C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.1\",\"matchCriteriaId\":\"EE543C0D-A06B-414F-A403-CB1E088F261E\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1caf50ce4af096d0280d59a31abdd85703cd995c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/ae385826840a3c8e09bf38cac90adcd690716f57\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d741534302f71c511eb0bb670b92eaa7df4a0aec\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T13:40:53+00:00",
      "cve": "CVE-2026-23224",
      "id": "CVE-2026-23224",
      "initial_release_date": "2026-02-18T00:00:00+00:00",
      "product_status:known_affected": "76",
      "product_status:known_not_affected": "198",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Linux kernel erofs: Denial of Service via Use-After-Free in file-backed directio mounts",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-23224.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-06T01:26:42Z",
      "cve": "CVE-2026-23224",
      "id": "CVE-2026-23224",
      "initial_release_date": "2026-02-19T00:26:31Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "5",
      "product_status:known_not_affected": "316",
      "product_status:recommended": "176",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-23224",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-23224.json",
      "version": "18"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.