CVE-2026-31454
xfs: save ailp before dropping the AIL lock in push callbacks
Description
In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid.
INFO
Published Date :
April 22, 2026, 2:16 p.m.
Last Modified :
April 22, 2026, 2:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Save ailp pointer in a local variable.
- Hold the AIL lock when accessing ailp.
- Apply the provided patch.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31454.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31454 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31454
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31454 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31454 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 22, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid. Added Reference https://git.kernel.org/stable/c/19437e4f7bb909afde832b39372aa2f3ce3cfd88 Added Reference https://git.kernel.org/stable/c/394d70b86fae9fe865e7e6d9540b7696f73aa9b6 Added Reference https://git.kernel.org/stable/c/4c7d50147316cf049462f327c4a3e9dc2b7f1dd0 Added Reference https://git.kernel.org/stable/c/50f5f056807b7bed74f4f307f2ca0ed92f3e556d Added Reference https://git.kernel.org/stable/c/6dbe17f19c290a72ce57d5abc70e1fad0c3e14e5 Added Reference https://git.kernel.org/stable/c/75669e987137f49c99ca44406bf0200d1892dd16 Added Reference https://git.kernel.org/stable/c/d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d Added Reference https://git.kernel.org/stable/c/edd1637d4e3911ab6c760f553f2040fe72f61a13