LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31586: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it.

HighCVSS 7.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

A race in Linux block-cgroup writeback cleanup can access memory after it has been freed. This can crash a kernel and is scored as potentially compromising confidentiality, integrity, and availability. The issue requires local access according to the CVSS vector; the supplied evidence does not establish remote exploitation.

Executive priority

Treat as a high-priority kernel maintenance issue, especially on shared compute and container fleets. Accelerate normal patching and reboot coordination. Emergency isolation is not supported by the supplied evidence because exploitation is local, no active attacks are documented, and no KEV listing is reported.

Technical view

cgwb_release_workfn() released its reference with css_put() before blkcg_unpin_online() finished using wb->blkcg_css. Asynchronous freeing could therefore leave blkcg_unpin_online() dereferencing freed memory. The fix reverses those operations so the reference keeps the block cgroup alive until access completes.

Likely exposure

Exposure applies to affected Linux kernel builds using the vulnerable block-cgroup writeback code. The bundle identifies affected releases from 4.19 through 7.1, with branch-specific stable fixes referenced. Multi-user, container, and fleet environments deserve priority, but exact exposure requires matching each deployed distribution kernel to vendor backports.

Exploitation context

The CVSS 7.8 vector describes local, low-privileged exploitation without user interaction and potentially high impact. A public reproducer and sporadic Meta fleet crashes confirm reachability. However, the CVE is not in KEV, and the supplied sources provide no evidence of malicious exploitation in the wild.

Researcher notes

The observed failure is a narrow lifetime race between reference release and online-pin decrement. KASAN confirmed a write after asynchronous blkcg freeing. The public reproducer demonstrates the crash condition, but its described timing injection artificially widens the race. Sources do not establish reliable privilege escalation, data compromise, or weaponized exploitation.

Mitigation direction

  • Install distribution kernel updates containing the applicable stable fix, then reboot into the updated kernel.
  • Prioritize shared, containerized, and other systems where untrusted users receive local access.
  • Match vendor-backported kernels against the referenced fixes rather than relying only on upstream version numbers.
  • If patching is delayed, consult distribution guidance; the supplied sources identify no supported workaround.

Validation and detection

  • Inventory running kernel versions across hosts, including distribution release and build identifiers.
  • Confirm each kernel includes its branch-specific stable fix or an equivalent vendor backport.
  • After rebooting, verify the running kernel is the patched build, not merely the installed package.
  • Review kernel logs and crash telemetry for cgwb_release_workfn, blkcg_unpin_online, KASAN, or use-after-free signatures.
Prepared
Confidence
medium
Sources
11

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31586 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
High
CVSS
7.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
10Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
7.8CVSS 3.1HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H1.85.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

7.8High
CVSS 3.1 vector shape for CVE-2026-31586Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9, 59b57717fff8b562825d9d25e0180ad7e8048ca9unaffected
LinuxLinux4.19, 0, 5.10.258, 5.15.209, 6.1.175, 6.6.136, 6.12.83, 6.18.24, 6.19.14, 7.0.1, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.