CVE-2026-31703
Use After Free in Linux Kernel writeback
Publication date: 2026-05-01
Last updated on: 2026-05-06
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | 7.1 |
| linux | linux_kernel | From 6.19 (inc) to 7.0.2 (exc) |
| linux | linux_kernel | From 6.18 (inc) to 6.18.25 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-416 | The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer. |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
The vulnerability has been resolved by removing the loop in the inode_switch_wbs_work_fn() function in the Linux kernel to prevent use-after-free issues.
To mitigate this vulnerability, you should update your Linux kernel to a version that includes this fix.
Can you explain this vulnerability to me?
This vulnerability is a use-after-free issue in the Linux kernel's writeback subsystem, specifically in the function inode_switch_wbs_work_fn().
The problem arises because inode_switch_wbs_work_fn() processes a list of work items in a loop, and during this process, the associated writeback structure (wb) can be freed while work is still pending. This happens when the work queue is empty but the work is still scheduled, leading to a situation where wb is freed but the work function tries to access it, causing a use-after-free error.
The fix involved removing the loop in inode_switch_wbs_work_fn() to ensure that when work is queued, the first item is guaranteed to be present and the wb reference is held until the work runs, preventing premature freeing and thus avoiding the use-after-free condition.
How can this vulnerability impact me? :
This use-after-free vulnerability can lead to undefined behavior in the Linux kernel, including potential system crashes, data corruption, or privilege escalation if exploited.
Because it involves kernel memory management, an attacker who can trigger this vulnerability might execute arbitrary code with kernel privileges or cause denial of service by crashing the system.