CVE-2026-31455
Analyzed Analyzed - Analysis Complete
Race Condition in Linux XFS Unmount Causes Potential Data Corruption

Publication date: 2026-04-22

Last updated on: 2026-06-05

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-22
Last Modified
2026-06-05
Generated
2026-06-16
AI Q&A
2026-04-22
EPSS Evaluated
2026-06-15
NVD
CVE-2026-31455
EUVD
EUVD-2026-24794
Affected Vendors & Products
Showing 13 associated CPEs
Vendor Product Version / Range
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel 7.0
linux linux_kernel From 5.11 (inc) to 5.15.203 (exc)
linux linux_kernel From 5.16 (inc) to 6.1.168 (exc)
linux linux_kernel From 6.13 (inc) to 6.18.21 (exc)
linux linux_kernel From 6.19 (inc) to 6.19.11 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.131 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.80 (exc)
linux linux_kernel From 5.9 (inc) to 5.10.253 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-416 The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's XFS filesystem unmount process. Specifically, during the unmount sequence in the function xfs_unmount_flush_inodes(), the Active Item List (AIL) was pushed while background reclaim and inode garbage collection (inodegc) were still running. This is problematic because inodegc can modify and add inodes to the AIL during the flush, and background reclaim can race to abort and free dirty inodes, leading to inconsistent or broken behavior.

The fix involves reordering the unmount process to stop inodegc and cancel background reclaim before pushing the AIL. This ensures that no background processes interfere with the AIL during unmount, preventing potential race conditions and data corruption.

Impact Analysis

This vulnerability can lead to data corruption or instability during the unmounting of XFS filesystems in the Linux kernel. Because background processes can modify or free inodes while the filesystem is being unmounted, it may cause filesystem inconsistencies, potential data loss, or system crashes.

Mitigation Strategies

The vulnerability is related to the Linux kernel's xfs filesystem unmount sequence. To mitigate this vulnerability, you should update your Linux kernel to a version where the issue has been resolved. The fix involves reordering the xfs_unmount_flush_inodes() function to stop inodegc and cancel background reclaim before pushing the AIL during unmount.

  • Apply the latest kernel patches or upgrade to a kernel version released after 2026-04-22 that includes the fix.
  • Avoid unmounting xfs filesystems on vulnerable kernel versions until patched.
Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-31455. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart