CVE-2026-31714
Memory Leak in Linux Kernel F2FS Filesystem
Publication date: 2026-05-01
Last updated on: 2026-05-01
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux_kernel | f2fs | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a memory leak in the Linux kernel's f2fs filesystem, specifically in the f2fs_rename() function.
The issue occurs because a call to f2fs_setup_filename() was added without a corresponding call to f2fs_free_filename(), causing allocated memory to not be freed properly.
This was reported by syzbot and involves unreferenced objects remaining in memory, which can lead to increased memory usage over time.
How can this vulnerability impact me? :
The memory leak in the f2fs_rename() function can cause the system to consume more memory than necessary, potentially leading to degraded performance or system instability if the leak is significant or exploited repeatedly.
Over time, this could result in resource exhaustion, affecting the reliability of systems using the f2fs filesystem.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability manifests as a memory leak in the Linux kernel's f2fs filesystem, specifically in the f2fs_rename() function.
Detection can be done by monitoring kernel logs for memory leak messages similar to the following pattern:
- Look for kernel BUG messages indicating unreferenced objects with comm "syz.0.23" or similar process names.
- Use commands like `dmesg | grep -i 'memory leak'` or `journalctl -k | grep -i 'memory leak'` to find relevant kernel log entries.
- Monitor for messages referencing f2fs_rename or related functions in the backtrace.
What immediate steps should I take to mitigate this vulnerability?
The vulnerability is fixed by ensuring that every call to f2fs_setup_filename() is matched with a call to f2fs_free_filename(), preventing the memory leak.
Immediate mitigation steps include:
- Update the Linux kernel to a version that includes the fix for this vulnerability (commit 40b2d55e0452 or later).
- If updating immediately is not possible, monitor system logs for memory leaks and consider limiting or avoiding operations that trigger f2fs_rename() until patched.