CVE-2026-31597
ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY
Description
In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward.
INFO
Published Date :
April 24, 2026, 3:16 p.m.
Last Modified :
June 1, 2026, 5:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Save ip_blkno before calling filemap_fault.
- Remove vma from the trace event.
- Apply the kernel patch to fix ocfs2_fault().
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-31597.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-31597 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-31597
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-31597 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-31597 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 01, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76 Added Reference https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94 Added Reference https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2 -
Initial Analysis by [email protected]
Apr. 29, 2026
Action Type Old Value New Value Added CWE CWE-416 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.24 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 6.19.14 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (excluding) 7.0.1 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.83 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 2.6.39 up to (excluding) 6.6.136 Added Reference Type kernel.org: https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2 Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 27, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Apr. 24, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward. Added Reference https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d Added Reference https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0 Added Reference https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2 Added Reference https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2