CVE-2026-31467: erofs: add GFP_NOIO in the bio completion if needed
In the Linux kernel, the following vulnerability has been resolved:
erofs: add GFP_NOIO in the bio completion if needed
The bio completion path in the process context (e.g. dm-verity)
will directly call into decompression rather than trigger another
workqueue context for minimal scheduling latencies, which can
then call vm_map_ram() with GFP_KERNEL.
Due to insufficient memory, vm_map_ram() may generate memory
swapping I/O, which can cause submit_bio_wait to deadlock
in some scenarios.
Trimmed down the call stack, as follows:
f2fs_submit_read_io
submit_bio //bio_list is initialized.
mmc_blk_mq_recovery
z_erofs_endio
vm_map_ram
__pte_alloc_kernel
__alloc_pages_direct_reclaim
shrink_folio_list
__swap_writepage
submit_bio_wait //bio_list is non-NULL, hang!!!
Use memalloc_noio_{save,restore}() to wrap up this path.
Security readout for executives and security teams
Plain-English summary
A Linux EROFS read can deadlock the storage path when low memory triggers swap I/O during decompression completion. A successful trigger may hang affected systems or workloads, causing denial of service. The source bundle does not establish data theft, data modification, or a reliable remote attack path.
Executive priority
Treat this as a high-priority availability issue for appliances, endpoints, or infrastructure relying on EROFS and verified storage. Patch exposed configurations during the next expedited maintenance window. Broader emergency action is not supported without evidence of affected usage, reliable external triggering, or active exploitation.
Technical view
In a process-context bio completion path, such as dm-verity, EROFS may decompress immediately and call vm_map_ram() with GFP_KERNEL. Under memory pressure, direct reclaim can initiate swap through submit_bio_wait() while a bio list is already active, causing deadlock. The fix wraps this path with memalloc_noio_save() and memalloc_noio_restore().
Likely exposure
Exposure is most plausible on affected Linux kernels using EROFS compressed reads through dm-verity or similar process-context bio completion, particularly under memory pressure. The supplied version data is flattened and ambiguous; assess exposure using distribution advisories and whether the kernel contains an applicable referenced fix.
Exploitation context
CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Although the bundle assigns CVSS 7.5 with a network vector, it does not show how an unauthenticated remote actor could reliably create the required EROFS I/O and memory-pressure conditions.
Researcher notes
The failure is a reclaim-recursion deadlock rather than a memory-corruption issue. Relevant review areas are EROFS compressed-read completion, z_erofs_endio, vm_map_ram(), direct reclaim, swap submission, and nested bio handling. The provided source lacks a CWE, practical trigger analysis, and clearly structured affected-version ranges.
Mitigation direction
Apply a distribution kernel update that incorporates the applicable Linux stable fix.
Reboot or otherwise activate the updated kernel according to vendor procedures.
If updates are unavailable, consult distribution guidance; the supplied sources provide no separate workaround.
Prioritize systems using EROFS with dm-verity or similar process-context completion paths.
Validation and detection
Inventory running kernel versions and identify systems mounting or consuming EROFS filesystems.
Determine whether dm-verity or another process-context bio completion path is used.
Confirm the installed kernel contains the applicable referenced stable commit or vendor backport.
Review kernel and storage logs for hangs coinciding with memory pressure and EROFS reads.
After updating, verify the fixed kernel is running and affected workloads complete normally.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Potential ATT&CK relevance
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
cve · low confidence lookup
CVE-2026-31467 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
1CVSS vectors
3Timeline events
0ADP providers
8Source links
CVSS vector scores
1 official score
We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.