GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-31589 (GCVE-0-2026-31589)

Vulnerability from cvelistv5 – Published: 2026-04-24 14:42 – Updated: 2026-08-05 12:23
VLAI
Title
mm: call ->free_folio() directly in folio_unmap_invalidate()
Summary
In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 , < efc52947247a21bbf79059539bbbd40f4ea76f00 (git)
Affected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 , < b667df39d98a7a24be7c2a40ff0863dac1ad2cd7 (git)
Affected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 , < c330e65ea59c4805d6ab6757c4ddfe8c63acef31 (git)
Affected: fb7d3bc4149395c1ae99029c852eab6c28fc3c88 , < 615d9bb2ccad42f9e21d837431e401db2e471195 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.14
Unaffected: 0 , < 6.14 (semver)
Unaffected: 6.18.27 , ≤ 6.18.* (semver)
Unaffected: 6.19.14 , ≤ 6.19.* (semver)
Unaffected: 7.0.1 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c",
            "mm/internal.h",
            "mm/truncate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "efc52947247a21bbf79059539bbbd40f4ea76f00",
              "status": "affected",
              "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
              "versionType": "git"
            },
            {
              "lessThan": "b667df39d98a7a24be7c2a40ff0863dac1ad2cd7",
              "status": "affected",
              "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
              "versionType": "git"
            },
            {
              "lessThan": "c330e65ea59c4805d6ab6757c4ddfe8c63acef31",
              "status": "affected",
              "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
              "versionType": "git"
            },
            {
              "lessThan": "615d9bb2ccad42f9e21d837431e401db2e471195",
              "status": "affected",
              "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "mm/filemap.c",
            "mm/internal.h",
            "mm/truncate.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.14"
            },
            {
              "lessThan": "6.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.27",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.14",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.1",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.27",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.14",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call -\u003efree_folio() directly in folio_unmap_invalidate()\n\nWe can only call filemap_free_folio() if we have a reference to (or hold a\nlock on) the mapping.  Otherwise, we\u0027ve already removed the folio from the\nmapping so it no longer pins the mapping and the mapping can be removed,\ncausing a use-after-free when accessing mapping-\u003ea_ops.\n\nFollow the same pattern as __remove_mapping() and load the free_folio\nfunction pointer before dropping the lock on the mapping.  That lets us\nmake filemap_free_folio() static as this was the only caller outside\nfilemap.c."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable path can be reached by remote NFS clients when nfsd is configured for NFSD_IO_DONTCACHE on a filesystem advertising FOP_DONTCACHE, causing remote READ/WRITE handling to set IOCB_DONTCACHE and enter the dropbehind invalidation path. This is a network-facing kernel service.\nAC:L - Once the affected DONTCACHE path is available, an attacker can repeatedly drive writeback/dropbehind and inode lifetime pressure with ordinary I/O operations. The race is attacker-influenced rather than dependent on an uncontrollable system state.\nPR:N - A remote NFS client can reach nfsd request processing without local shell access or kernel capabilities on the target; permissive or anonymous exports make the relevant file operations reachable without prior target privileges. When uncertain between N and L, N is the higher-severity defensible choice.\nUI:N - No victim user action is needed after the service and export are available. The attacker triggers the path by sending I/O requests.\nS:U - The vulnerability corrupts/uses freed memory inside the same kernel security authority that processes the request. It is not a VM escape, IOMMU bypass, or cross-authority boundary violation.\nC:H - The bug is a use-after-free of the address_space/inode-backed mapping when dereferencing mapping-\u003ea_ops after the folio no longer pins the mapping. Kernel UAFs are defensibly scored as high confidentiality impact because they can be shaped into kernel memory disclosure primitives.\nI:H - The stale mapping dereference includes an indirect free_folio function pointer lookup and potential call, making control-flow or memory corruption exploitation defensible. Kernel UAFs are scored high for integrity under the provided guidance.\nA:H - At minimum, dereferencing mapping-\u003ea_ops after the mapping has been freed can crash or oops the kernel. The attacker can trigger the vulnerable path repeatedly, so availability impact is high."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:23:40.286Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/efc52947247a21bbf79059539bbbd40f4ea76f00"
        },
        {
          "url": "https://git.kernel.org/stable/c/b667df39d98a7a24be7c2a40ff0863dac1ad2cd7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c330e65ea59c4805d6ab6757c4ddfe8c63acef31"
        },
        {
          "url": "https://git.kernel.org/stable/c/615d9bb2ccad42f9e21d837431e401db2e471195"
        }
      ],
      "title": "mm: call -\u003efree_folio() directly in folio_unmap_invalidate()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31589",
    "datePublished": "2026-04-24T14:42:16.955Z",
    "dateReserved": "2026-03-09T15:48:24.120Z",
    "dateUpdated": "2026-08-05T12:23:40.286Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-31589",
      "date": "2026-09-19",
      "epss": "0.00444",
      "percentile": "0.38036"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "mm/filemap.c",
                  "mm/internal.h",
                  "mm/truncate.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "efc52947247a21bbf79059539bbbd40f4ea76f00",
                    "status": "affected",
                    "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b667df39d98a7a24be7c2a40ff0863dac1ad2cd7",
                    "status": "affected",
                    "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c330e65ea59c4805d6ab6757c4ddfe8c63acef31",
                    "status": "affected",
                    "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "615d9bb2ccad42f9e21d837431e401db2e471195",
                    "status": "affected",
                    "version": "fb7d3bc4149395c1ae99029c852eab6c28fc3c88",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "mm/filemap.c",
                  "mm/internal.h",
                  "mm/truncate.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.14"
                  },
                  {
                    "lessThan": "6.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.27",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.19.*",
                    "status": "unaffected",
                    "version": "6.19.14",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.1",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "24221FC1-03CA-4C3B-99B7-27AFF9FC5FAE",
                    "versionEndExcluding": "6.19.14",
                    "versionStartIncluding": "6.14",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A",
                    "versionEndExcluding": "7.0.1",
                    "versionStartIncluding": "7.0",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: call -\u003efree_folio() directly in folio_unmap_invalidate()\n\nWe can only call filemap_free_folio() if we have a reference to (or hold a\nlock on) the mapping.  Otherwise, we\u0027ve already removed the folio from the\nmapping so it no longer pins the mapping and the mapping can be removed,\ncausing a use-after-free when accessing mapping-\u003ea_ops.\n\nFollow the same pattern as __remove_mapping() and load the free_folio\nfunction pointer before dropping the lock on the mapping.  That lets us\nmake filemap_free_folio() static as this was the only caller outside\nfilemap.c."
          }
        ],
        "id": "CVE-2026-31589",
        "lastModified": "2026-06-17T10:34:02.407",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-04-24T15:16:34.700",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/615d9bb2ccad42f9e21d837431e401db2e471195"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b667df39d98a7a24be7c2a40ff0863dac1ad2cd7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/c330e65ea59c4805d6ab6757c4ddfe8c63acef31"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/efc52947247a21bbf79059539bbbd40f4ea76f00"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Modified",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-416"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-14T18:44:28+00:00",
      "cve": "CVE-2026-31589",
      "id": "CVE-2026-31589",
      "initial_release_date": "2026-04-24T00:00:00+00:00",
      "product_status:known_affected": "119",
      "product_status:known_not_affected": "155",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: mm: call -\u003efree_folio() directly in folio_unmap_invalidate()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-31589.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-11T01:30:23Z",
      "cve": "CVE-2026-31589",
      "id": "CVE-2026-31589",
      "initial_release_date": "2026-04-25T01:38:39Z",
      "product_status:known_affected": "110",
      "product_status:known_not_affected": "284",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-31589",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-31589.json",
      "version": "9"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.