CVE-2026-31519 (GCVE-0-2026-31519)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:54 – Updated: 2026-05-23 16:05
VLAI
Title
btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create
Summary
In the Linux kernel, the following vulnerability has been resolved: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create We have recently observed a number of subvolumes with broken dentries. ls-ing the parent dir looks like: drwxrwxrwt 1 root root 16 Jan 23 16:49 . drwxr-xr-x 1 root root 24 Jan 23 16:48 .. d????????? ? ? ? ? ? broken_subvol and similarly stat-ing the file fails. In this state, deleting the subvol fails with ENOENT, but attempting to create a new file or subvol over it errors out with EEXIST and even aborts the fs. Which leaves us a bit stuck. dmesg contains a single notable error message reading: "could not do orphan cleanup -2" 2 is ENOENT and the error comes from the failure handling path of btrfs_orphan_cleanup(), with the stack leading back up to btrfs_lookup(). btrfs_lookup btrfs_lookup_dentry btrfs_orphan_cleanup // prints that message and returns -ENOENT After some detailed inspection of the internal state, it became clear that: - there are no orphan items for the subvol - the subvol is otherwise healthy looking, it is not half-deleted or anything, there is no drop progress, etc. - the subvol was created a while ago and does the meaningful first btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much later. - after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT, which results in a negative dentry for the subvolume via d_splice_alias(NULL, dentry), leading to the observed behavior. The bug can be mitigated by dropping the dentry cache, at which point we can successfully delete the subvolume if we want. i.e., btrfs_lookup() btrfs_lookup_dentry() if (!sb_rdonly(inode->vfs_inode)->vfs_inode) btrfs_orphan_cleanup(sub_root) test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) btrfs_search_slot() // finds orphan item for inode N ... prints "could not do orphan cleanup -2" if (inode == ERR_PTR(-ENOENT)) inode = NULL; return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume btrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP) on the root when it runs, so it cannot run more than once on a given root, so something else must run concurrently. However, the obvious routes to deleting an orphan when nlinks goes to 0 should not be able to run without first doing a lookup into the subvolume, which should run btrfs_orphan_cleanup() and set the bit. The final important observation is that create_subvol() calls d_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if the dentry cache gets dropped, the next lookup into the subvolume will make a real call into btrfs_orphan_cleanup() for the first time. This opens up the possibility of concurrently deleting the inode/orphan items but most typical evict() paths will be holding a reference on the parent dentry (child dentry holds parent->d_lockref.count via dget in d_alloc(), released in __dentry_kill()) and prevent the parent from being removed from the dentry cache. The one exception is delayed iputs. Ordered extent creation calls igrab() on the inode. If the file is unlinked and closed while those refs are held, iput() in __dentry_kill() decrements i_count but does not trigger eviction (i_count > 0). The child dentry is freed and the subvol dentry's d_lockref.count drops to 0, making it evictable while the inode is still alive. Since there are two races (the race between writeback and unlink and the race between lookup and delayed iputs), and there are too many moving parts, the following three diagrams show the complete picture. (Only the second and third are races) Phase 1: Create Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set btrfs_mksubvol() lookup_one_len() __lookup_slow() d_alloc_parallel() __d_alloc() // d_lockref.count = 1 create_subvol(dentry) // doesn't touch the bit.. d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c ---truncated---
Severity
5.5 (Medium)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < d43da8de0ed376abafbad8a245a1835e8f66cb0f (git)
Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < c57276ced3c3207f42182dfa2f0d8e860357e111 (git)
Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < a41a9b8d19a98b45591528c6e54d31cc66271d1e (git)
Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < 2ec578e6452138ab76f6c9a9c18711fcd197649f (git)
Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < 696683f214495db3cdacab9a713efaaced8660f8 (git)
Affected: c71bf099abddf3e0fdc27f251ba76fca1461d49a , < 5131fa077f9bb386a1b901bf5b247041f0ec8f80 (git)
Affected: c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb (git)
Affected: 2.6.32.19 , < 2.6.33 (semver)
Create a notification for this product.
Linux Linux Affected: 2.6.33
Unaffected: 0 , < 2.6.33 (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "d43da8de0ed376abafbad8a245a1835e8f66cb0f",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "lessThan": "c57276ced3c3207f42182dfa2f0d8e860357e111",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "lessThan": "a41a9b8d19a98b45591528c6e54d31cc66271d1e",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "lessThan": "2ec578e6452138ab76f6c9a9c18711fcd197649f",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "lessThan": "696683f214495db3cdacab9a713efaaced8660f8",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "lessThan": "5131fa077f9bb386a1b901bf5b247041f0ec8f80",
              "status": "affected",
              "version": "c71bf099abddf3e0fdc27f251ba76fca1461d49a",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb",
              "versionType": "git"
            },
            {
              "lessThan": "2.6.33",
              "status": "affected",
              "version": "2.6.32.19",
              "versionType": "semver"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/btrfs/ioctl.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.33"
            },
            {
              "lessThan": "2.6.33",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "2.6.33",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionStartIncluding": "2.6.32.19",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbtrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\n\nWe have recently observed a number of subvolumes with broken dentries.\nls-ing the parent dir looks like:\n\ndrwxrwxrwt 1 root root 16 Jan 23 16:49 .\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\nd????????? ? ?    ?     ?            ? broken_subvol\n\nand similarly stat-ing the file fails.\n\nIn this state, deleting the subvol fails with ENOENT, but attempting to\ncreate a new file or subvol over it errors out with EEXIST and even\naborts the fs. Which leaves us a bit stuck.\n\ndmesg contains a single notable error message reading:\n\"could not do orphan cleanup -2\"\n\n2 is ENOENT and the error comes from the failure handling path of\nbtrfs_orphan_cleanup(), with the stack leading back up to\nbtrfs_lookup().\n\nbtrfs_lookup\nbtrfs_lookup_dentry\nbtrfs_orphan_cleanup // prints that message and returns -ENOENT\n\nAfter some detailed inspection of the internal state, it became clear\nthat:\n- there are no orphan items for the subvol\n- the subvol is otherwise healthy looking, it is not half-deleted or\n  anything, there is no drop progress, etc.\n- the subvol was created a while ago and does the meaningful first\n  btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much\n  later.\n- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,\n  which results in a negative dentry for the subvolume via\n  d_splice_alias(NULL, dentry), leading to the observed behavior. The\n  bug can be mitigated by dropping the dentry cache, at which point we\n  can successfully delete the subvolume if we want.\n\ni.e.,\nbtrfs_lookup()\n  btrfs_lookup_dentry()\n    if (!sb_rdonly(inode-\u003evfs_inode)-\u003evfs_inode)\n    btrfs_orphan_cleanup(sub_root)\n      test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\n      btrfs_search_slot() // finds orphan item for inode N\n      ...\n      prints \"could not do orphan cleanup -2\"\n  if (inode == ERR_PTR(-ENOENT))\n    inode = NULL;\n  return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume\n\nbtrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\non the root when it runs, so it cannot run more than once on a given\nroot, so something else must run concurrently. However, the obvious\nroutes to deleting an orphan when nlinks goes to 0 should not be able to\nrun without first doing a lookup into the subvolume, which should run\nbtrfs_orphan_cleanup() and set the bit.\n\nThe final important observation is that create_subvol() calls\nd_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if\nthe dentry cache gets dropped, the next lookup into the subvolume will\nmake a real call into btrfs_orphan_cleanup() for the first time. This\nopens up the possibility of concurrently deleting the inode/orphan items\nbut most typical evict() paths will be holding a reference on the parent\ndentry (child dentry holds parent-\u003ed_lockref.count via dget in\nd_alloc(), released in __dentry_kill()) and prevent the parent from\nbeing removed from the dentry cache.\n\nThe one exception is delayed iputs. Ordered extent creation calls\nigrab() on the inode. If the file is unlinked and closed while those\nrefs are held, iput() in __dentry_kill() decrements i_count but does\nnot trigger eviction (i_count \u003e 0). The child dentry is freed and the\nsubvol dentry\u0027s d_lockref.count drops to 0, making it evictable while\nthe inode is still alive.\n\nSince there are two races (the race between writeback and unlink and\nthe race between lookup and delayed iputs), and there are too many moving\nparts, the following three diagrams show the complete picture.\n(Only the second and third are races)\n\nPhase 1:\nCreate Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set\n\nbtrfs_mksubvol()\n  lookup_one_len()\n    __lookup_slow()\n      d_alloc_parallel()\n        __d_alloc() // d_lockref.count = 1\n  create_subvol(dentry)\n    // doesn\u0027t touch the bit..\n    d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c\n---truncated---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-23T16:05:15.433Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/d43da8de0ed376abafbad8a245a1835e8f66cb0f"
        },
        {
          "url": "https://git.kernel.org/stable/c/c57276ced3c3207f42182dfa2f0d8e860357e111"
        },
        {
          "url": "https://git.kernel.org/stable/c/a41a9b8d19a98b45591528c6e54d31cc66271d1e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2ec578e6452138ab76f6c9a9c18711fcd197649f"
        },
        {
          "url": "https://git.kernel.org/stable/c/696683f214495db3cdacab9a713efaaced8660f8"
        },
        {
          "url": "https://git.kernel.org/stable/c/5131fa077f9bb386a1b901bf5b247041f0ec8f80"
        }
      ],
      "title": "btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31519",
    "datePublished": "2026-04-22T13:54:34.860Z",
    "dateReserved": "2026-03-09T15:48:24.108Z",
    "dateUpdated": "2026-05-23T16:05:15.433Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31519",
      "date": "2026-08-15",
      "epss": "0.00123",
      "percentile": "0.0244"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-31519\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-04-22T14:16:51.580\",\"lastModified\":\"2026-06-17T10:33:54.097\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nbtrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create\\n\\nWe have recently observed a number of subvolumes with broken dentries.\\nls-ing the parent dir looks like:\\n\\ndrwxrwxrwt 1 root root 16 Jan 23 16:49 .\\ndrwxr-xr-x 1 root root 24 Jan 23 16:48 ..\\nd????????? ? ?    ?     ?            ? broken_subvol\\n\\nand similarly stat-ing the file fails.\\n\\nIn this state, deleting the subvol fails with ENOENT, but attempting to\\ncreate a new file or subvol over it errors out with EEXIST and even\\naborts the fs. Which leaves us a bit stuck.\\n\\ndmesg contains a single notable error message reading:\\n\\\"could not do orphan cleanup -2\\\"\\n\\n2 is ENOENT and the error comes from the failure handling path of\\nbtrfs_orphan_cleanup(), with the stack leading back up to\\nbtrfs_lookup().\\n\\nbtrfs_lookup\\nbtrfs_lookup_dentry\\nbtrfs_orphan_cleanup // prints that message and returns -ENOENT\\n\\nAfter some detailed inspection of the internal state, it became clear\\nthat:\\n- there are no orphan items for the subvol\\n- the subvol is otherwise healthy looking, it is not half-deleted or\\n  anything, there is no drop progress, etc.\\n- the subvol was created a while ago and does the meaningful first\\n  btrfs_orphan_cleanup() call that sets BTRFS_ROOT_ORPHAN_CLEANUP much\\n  later.\\n- after btrfs_orphan_cleanup() fails, btrfs_lookup_dentry() returns -ENOENT,\\n  which results in a negative dentry for the subvolume via\\n  d_splice_alias(NULL, dentry), leading to the observed behavior. The\\n  bug can be mitigated by dropping the dentry cache, at which point we\\n  can successfully delete the subvolume if we want.\\n\\ni.e.,\\nbtrfs_lookup()\\n  btrfs_lookup_dentry()\\n    if (!sb_rdonly(inode-\u003evfs_inode)-\u003evfs_inode)\\n    btrfs_orphan_cleanup(sub_root)\\n      test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\\n      btrfs_search_slot() // finds orphan item for inode N\\n      ...\\n      prints \\\"could not do orphan cleanup -2\\\"\\n  if (inode == ERR_PTR(-ENOENT))\\n    inode = NULL;\\n  return d_splice_alias(NULL, dentry) // NEGATIVE DENTRY for valid subvolume\\n\\nbtrfs_orphan_cleanup() does test_and_set_bit(BTRFS_ROOT_ORPHAN_CLEANUP)\\non the root when it runs, so it cannot run more than once on a given\\nroot, so something else must run concurrently. However, the obvious\\nroutes to deleting an orphan when nlinks goes to 0 should not be able to\\nrun without first doing a lookup into the subvolume, which should run\\nbtrfs_orphan_cleanup() and set the bit.\\n\\nThe final important observation is that create_subvol() calls\\nd_instantiate_new() but does not set BTRFS_ROOT_ORPHAN_CLEANUP, so if\\nthe dentry cache gets dropped, the next lookup into the subvolume will\\nmake a real call into btrfs_orphan_cleanup() for the first time. This\\nopens up the possibility of concurrently deleting the inode/orphan items\\nbut most typical evict() paths will be holding a reference on the parent\\ndentry (child dentry holds parent-\u003ed_lockref.count via dget in\\nd_alloc(), released in __dentry_kill()) and prevent the parent from\\nbeing removed from the dentry cache.\\n\\nThe one exception is delayed iputs. Ordered extent creation calls\\nigrab() on the inode. If the file is unlinked and closed while those\\nrefs are held, iput() in __dentry_kill() decrements i_count but does\\nnot trigger eviction (i_count \u003e 0). The child dentry is freed and the\\nsubvol dentry\u0027s d_lockref.count drops to 0, making it evictable while\\nthe inode is still alive.\\n\\nSince there are two races (the race between writeback and unlink and\\nthe race between lookup and delayed iputs), and there are too many moving\\nparts, the following three diagrams show the complete picture.\\n(Only the second and third are races)\\n\\nPhase 1:\\nCreate Subvol in dentry cache without BTRFS_ROOT_ORPHAN_CLEANUP set\\n\\nbtrfs_mksubvol()\\n  lookup_one_len()\\n    __lookup_slow()\\n      d_alloc_parallel()\\n        __d_alloc() // d_lockref.count = 1\\n  create_subvol(dentry)\\n    // doesn\u0027t touch the bit..\\n    d_instantiate_new(dentry, inode) // dentry in cache with d_lockref.c\\n---truncated---\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"fs/btrfs/ioctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"d43da8de0ed376abafbad8a245a1835e8f66cb0f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"c57276ced3c3207f42182dfa2f0d8e860357e111\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"a41a9b8d19a98b45591528c6e54d31cc66271d1e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"2ec578e6452138ab76f6c9a9c18711fcd197649f\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"696683f214495db3cdacab9a713efaaced8660f8\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c71bf099abddf3e0fdc27f251ba76fca1461d49a\",\"lessThan\":\"5131fa077f9bb386a1b901bf5b247041f0ec8f80\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"c4ba0bd9db5e8fd2664be0fd4ec01335fe3268eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"2.6.32.19\",\"lessThan\":\"2.6.33\",\"versionType\":\"semver\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"fs/btrfs/ioctl.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.33\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.33\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.168\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.131\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.80\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.21\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.19.11\",\"lessThanOrEqual\":\"6.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.32.19\",\"versionEndExcluding\":\"2.6.33\",\"matchCriteriaId\":\"495F91B8-83FD-48D7-9D47-5088CDFF7B18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"2.6.33\",\"versionEndExcluding\":\"6.1.168\",\"matchCriteriaId\":\"94AAE858-E85D-4733-BCA5-FB4C40663DF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.131\",\"matchCriteriaId\":\"CE6ED4D4-0046-4573-BFA9-D64143B6A89F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.80\",\"matchCriteriaId\":\"97EB19EC-A11E-49C6-9D2F-6F6EC6CB98B6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.21\",\"matchCriteriaId\":\"ED39847A-3B46-4729-B7CA-B2C30B9FA8FE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"6.19.11\",\"matchCriteriaId\":\"4CA2E747-A9EC-4518-9AA2-B4247FC748B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F253B622-8837-4245-BCE5-A7BF8FC76A16\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"F666C8D8-6538-46D4-B318-87610DE64C34\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/2ec578e6452138ab76f6c9a9c18711fcd197649f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5131fa077f9bb386a1b901bf5b247041f0ec8f80\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/696683f214495db3cdacab9a713efaaced8660f8\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a41a9b8d19a98b45591528c6e54d31cc66271d1e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/c57276ced3c3207f42182dfa2f0d8e860357e111\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/d43da8de0ed376abafbad8a245a1835e8f66cb0f\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-06-28T07:25:57+00:00",
      "cve": "CVE-2026-31519",
      "id": "CVE-2026-31519",
      "initial_release_date": "2026-04-22T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "14",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: btrfs: set BTRFS_ROOT_ORPHAN_CLEANUP during subvol create",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31519.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-07-19T17:41:10Z",
      "cve": "CVE-2026-31519",
      "id": "CVE-2026-31519",
      "initial_release_date": "2026-04-23T01:25:01Z",
      "product_status:first_fixed": "2",
      "product_status:known_affected": "614",
      "product_status:recommended": "295",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31519",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31519.json",
      "version": "22"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.