CVE-2026-31446
Use-After-Free in Linux ext4 sysfs Notification During Unmount
Publication date: 2026-04-22
Last updated on: 2026-04-27
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to undefined behavior in the kernel, such as system crashes, memory corruption, or potential escalation of privileges if exploited. Because it involves accessing freed memory, it could be leveraged by an attacker to execute arbitrary code within the kernel context or cause denial of service by crashing the system.
Can you explain this vulnerability to me?
This vulnerability is a use-after-free bug in the Linux kernel's ext4 filesystem code. It occurs during the unmount process when the system tries to update the superblock work while racing with the unmount operation. Specifically, a function called update_super_work calls ext4_notify_error_sysfs(), which in turn calls sysfs_notify() that accesses a kernel object (kobject) that has already been freed. This happens because ext4_unregister_sysfs() deletes the kobject before the notification, leading to a stale pointer dereference and use-after-free condition.
The fix involves adding a check in ext4_notify_error_sysfs() to detect if the sysfs has already been torn down and skipping the notification call if so. Additionally, a mutex is used to serialize access and prevent race conditions where the kobject could be deleted between the check and the notification call.
What immediate steps should I take to mitigate this vulnerability?
This vulnerability is a use-after-free bug in the ext4 filesystem code of the Linux kernel related to unmount operations. To mitigate this vulnerability, the best immediate step is to update your Linux kernel to a version that includes the fix described.
The fix involves changes to the ext4_notify_error_sysfs() function to avoid accessing freed memory during unmount, so applying the patch or upgrading to a kernel version released after 2026-04-22 that contains this fix will prevent exploitation.