LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31467: erofs: add GFP_NOIO in the bio completion if needed

In the Linux kernel, the following vulnerability has been resolved: erofs: add GFP_NOIO in the bio completion if needed The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vm_map_ram() with GFP_KERNEL. Due to insufficient memory, vm_map_ram() may generate memory swapping I/O, which can cause submit_bio_wait to deadlock in some scenarios. Trimmed down the call stack, as follows: f2fs_submit_read_io submit_bio //bio_list is initialized. mmc_blk_mq_recovery z_erofs_endio vm_map_ram __pte_alloc_kernel __alloc_pages_direct_reclaim shrink_folio_list __swap_writepage submit_bio_wait //bio_list is non-NULL, hang!!! Use memalloc_noio_{save,restore}() to wrap up this path.

HighCVSS 7.5Not KEV-listedUpdated
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A Linux EROFS read can deadlock the storage path when low memory triggers swap I/O during decompression completion. A successful trigger may hang affected systems or workloads, causing denial of service. The source bundle does not establish data theft, data modification, or a reliable remote attack path.

Executive priority

Treat this as a high-priority availability issue for appliances, endpoints, or infrastructure relying on EROFS and verified storage. Patch exposed configurations during the next expedited maintenance window. Broader emergency action is not supported without evidence of affected usage, reliable external triggering, or active exploitation.

Technical view

In a process-context bio completion path, such as dm-verity, EROFS may decompress immediately and call vm_map_ram() with GFP_KERNEL. Under memory pressure, direct reclaim can initiate swap through submit_bio_wait() while a bio list is already active, causing deadlock. The fix wraps this path with memalloc_noio_save() and memalloc_noio_restore().

Likely exposure

Exposure is most plausible on affected Linux kernels using EROFS compressed reads through dm-verity or similar process-context bio completion, particularly under memory pressure. The supplied version data is flattened and ambiguous; assess exposure using distribution advisories and whether the kernel contains an applicable referenced fix.

Exploitation context

CISA KEV status is false, and the supplied sources provide no evidence of active exploitation or a public exploit. Although the bundle assigns CVSS 7.5 with a network vector, it does not show how an unauthenticated remote actor could reliably create the required EROFS I/O and memory-pressure conditions.

Researcher notes

The failure is a reclaim-recursion deadlock rather than a memory-corruption issue. Relevant review areas are EROFS compressed-read completion, z_erofs_endio, vm_map_ram(), direct reclaim, swap submission, and nested bio handling. The provided source lacks a CWE, practical trigger analysis, and clearly structured affected-version ranges.

Mitigation direction

  • Apply a distribution kernel update that incorporates the applicable Linux stable fix.
  • Reboot or otherwise activate the updated kernel according to vendor procedures.
  • If updates are unavailable, consult distribution guidance; the supplied sources provide no separate workaround.
  • Prioritize systems using EROFS with dm-verity or similar process-context completion paths.

Validation and detection

  • Inventory running kernel versions and identify systems mounting or consuming EROFS filesystems.
  • Determine whether dm-verity or another process-context bio completion path is used.
  • Confirm the installed kernel contains the applicable referenced stable commit or vendor backport.
  • Review kernel and storage logs for hangs coinciding with memory pressure and EROFS reads.
  • After updating, verify the fixed kernel is running and affected workloads complete normally.
Prepared
Confidence
high
Sources
9

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31467 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.5 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
8Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.5CVSS 3.1HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H3.93.6Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.5High
CVSS 3.1 vector shape for CVE-2026-31467Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbe, 648f2de053a882c87c05f0060f47d3b11841fdbeunaffected
LinuxLinux5.13, 0, 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, 7.0affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.