Answer in brief
CVE-2026-31715 records a High severity (CVSS 7.8) vulnerability in f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
Answer in brief
CVE-2026-31715 records a High severity (CVSS 7.8) vulnerability in f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io(). The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <7dbdab4430e4654db9aacef12b9b3b8b29ca25cb || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <ffb94770dbdfb5411be5d9f44a960b010ec890ad || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <0d40b26377f891e6dcb6efaf8ef9374c99be1b1d || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <1171f329cf1c175321251ac40fd126150d7ad1e8 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <7be222de96c0f9eee6e65eeb017ef855ee185cfa || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <963d2e24d9d92a31e6773b0f642214f10013ebf7 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <188bb65f247a7a7c62f287c9a263aee3cad96fa5 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 | 7dbdab4430e4654db9aacef12b9b3b8b29ca25cb, ffb94770dbdfb5411be5d9f44a960b010ec890ad, 0d40b26377f891e6dcb6efaf8ef9374c99be1b1d, 1171f329cf1c175321251ac40fd126150d7ad1e8, 7be222de96c0f9eee6e65eeb017ef855ee185cfa, 963d2e24d9d92a31e6773b0f642214f10013ebf7, 188bb65f247a7a7c62f287c9a263aee3cad96fa5, 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic. This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition.
Quoted source text, attributed separately from HOL analysis.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <7dbdab4430e4654db9aacef12b9b3b8b29ca25cb || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <ffb94770dbdfb5411be5d9f44a960b010ec890ad || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <0d40b26377f891e6dcb6efaf8ef9374c99be1b1d || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <1171f329cf1c175321251ac40fd126150d7ad1e8 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <7be222de96c0f9eee6e65eeb017ef855ee185cfa || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <963d2e24d9d92a31e6773b0f642214f10013ebf7 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <188bb65f247a7a7c62f287c9a263aee3cad96fa5 || >=50fa53eccf9f911a5b435248a2b0bd484fd82e5e <2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 | 7dbdab4430e4654db9aacef12b9b3b8b29ca25cb, ffb94770dbdfb5411be5d9f44a960b010ec890ad, 0d40b26377f891e6dcb6efaf8ef9374c99be1b1d, 1171f329cf1c175321251ac40fd126150d7ad1e8, 7be222de96c0f9eee6e65eeb017ef855ee185cfa, 963d2e24d9d92a31e6773b0f642214f10013ebf7, 188bb65f247a7a7c62f287c9a263aee3cad96fa5, 2d9c4a4ed4eef1f82c5b16b037aee8bad819fd53 |
| Linux/Linuxgeneric | 4.19 | Not reported |
Published upstream
May 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Jun 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jun 19, 2026
In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic. This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition.
Quoted source text, attributed separately from HOL analysis.