LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31454: xfs: save ailp before dropping the AIL lock in push callbacks

In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in the Linux kernel’s XFS filesystem can access memory after it has been freed. A local, low-privileged user may potentially crash the system or compromise confidentiality and integrity. Systems using affected kernels with active XFS filesystems deserve prompt review, although the supplied evidence does not demonstrate successful exploitation.

Executive priority

Treat this as a high-priority kernel maintenance issue, especially for shared Linux systems, hosting platforms, and servers using XFS with local user access. It is less urgent for systems without XFS or without meaningful local access, but exposure should be verified rather than assumed. No active exploitation is established in the supplied evidence.

Technical view

The XFS inode and quota-item push callbacks release the Active Item List lock for buffer I/O, allowing background reclaim to free the log item. Reacquiring the lock then dereferences the freed item’s li_ailp pointer. The stable fix preserves the AIL pointer locally while the item remains protected. CVSS 3.1 is 7.8 with local, low-privileged access required.

Likely exposure

Exposure is most likely on systems running an affected Linux kernel and actively using XFS, particularly where low-privileged users can execute local code. The supplied version data spans multiple kernel lines but is not sufficiently clear for reliable version-only decisions. Distribution backports may also alter status, so map installed packages to vendor guidance or the referenced fixes.

Exploitation context

The supplied record reports no CISA KEV listing and provides no evidence of active exploitation or a public exploit. The attack vector is local, requires low privileges, and needs no user interaction. The race depends on XFS log-item processing and reclamation timing, so practical exploitability is not established by these sources.

Researcher notes

The vulnerable lifetime transition occurs after the cluster buffer stops protecting the log item and the AIL lock is dropped. Reclaim or the dquot shrinker may free that item before spin_lock dereferences li_ailp. The fix changes pointer lifetime handling rather than adding an authorization boundary. Precise affected-version interpretation and exploitability require further vendor-specific evidence.

Mitigation direction

  • Install a distribution kernel update containing the applicable stable fix, following vendor reboot guidance.
  • Prioritize affected systems using XFS and permitting untrusted or low-privileged local code execution.
  • Restrict unnecessary local access until patched; this reduces opportunity but does not remove the vulnerability.
  • Consult the Linux distributor when package backports make upstream version comparisons inconclusive.

Validation and detection

  • Inventory running kernel builds and identify hosts actively mounting or using XFS filesystems.
  • Map vendor packages to fixed commits or explicit distributor advisories, not upstream version strings alone.
  • After updating and rebooting, confirm each host runs the intended remediated kernel build.
  • Review telemetry for XFS errors, kernel oopses, or unexpected crashes; their absence does not prove safety.
Prepared
Confidence
medium
Sources
10

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31454 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
9Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31454Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34unaffected
LinuxLinux5.9, 0, 5.10.253, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.