LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31589: mm: call ->free_folio() directly in folio_unmap_invalidate()

In the Linux kernel, the following vulnerability has been resolved: mm: call ->free_folio() directly in folio_unmap_invalidate() We can only call filemap_free_folio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->a_ops. Follow the same pattern as __remove_mapping() and load the free_folio function pointer before dropping the lock on the mapping. That lets us make filemap_free_folio() static as this was the only caller outside filemap.c.

CriticalCVSS 9.8Not KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysiscritical

Security readout for executives and security teams

Plain-English summary

A Linux kernel memory-lifecycle error can access a filesystem mapping after it has been freed. This use-after-free could crash a system or compromise confidentiality, integrity, and availability. The supplied record rates it critical, but does not establish that every affected system is remotely reachable or practically exploitable.

Executive priority

Treat as an urgent kernel patching and applicability-assessment item because the record is critical and describes use-after-free memory corruption. Avoid declaring an active emergency solely from the CVSS score: exploitation evidence and real-world reachability are not established in the supplied material.

Technical view

folio_unmap_invalidate() could remove a folio, release the mapping lock, and later access mapping->a_ops after the mapping was freed. The fix captures the free_folio function pointer while the mapping remains protected, following __remove_mapping(). Four Linux stable commit references are supplied.

Likely exposure

Potential exposure is limited to Linux kernels covered by the affected-version record and lacking the relevant stable fix. The supplied version data includes ambiguous entries, including “0,” and does not provide clear ranges. Distribution backports mean kernel version strings alone may be insufficient.

Exploitation context

The supplied CVSS vector describes network-accessible, low-complexity, unauthenticated exploitation without user interaction. However, the sources provided do not explain a remotely reachable trigger or practical attack prerequisites. The KEV flag is false, and no supplied source reports active exploitation or public weaponization.

Researcher notes

The central race is loss of mapping lifetime protection before dereferencing mapping->a_ops. Researchers should examine folio_unmap_invalidate() reachability, filesystem-specific free_folio implementations, concurrency requirements, and distribution backports. The affected-version metadata is insufficiently precise for reliable range conclusions, and the CVSS network vector is not substantiated by trigger details here.

Mitigation direction

  • Install a vendor-supported kernel update containing the applicable referenced stable fix.
  • Confirm distribution backports using package advisories or changelogs, not version strings alone.
  • Prioritize externally exposed and high-value Linux systems while vendor applicability is assessed.
  • Consult Linux distribution guidance because no temporary workaround is identified in the supplied sources.

Validation and detection

  • Inventory running kernels and map them against vendor advisories for CVE-2026-31589.
  • Verify the installed kernel contains an applicable referenced fix or documented vendor backport.
  • After updating, confirm systems booted into the remediated kernel rather than an older installed kernel.
  • Review kernel diagnostics for crashes or memory-corruption warnings, while recognizing absence does not prove safety.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31589 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Critical
CVSS
9.8 (3.1)
Known Exploited
No
Published

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

1CVSS vectors
3Timeline events
0ADP providers
5Source links

CVSS vector scores

1 official score

We collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.

ScoreVersionSeverityVectorExploitImpactSource
9.8CVSS 3.1CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Linux

Vulnerability scoring details

Base CVSS 3.1 score

9.8Critical
CVSS 3.1 vector shape for CVE-2026-31589Attack VectorAttack ComplexityPrivileges RequiredUser InteractionScopeConfidentiality ImpactIntegrity ImpactAvailability Impact

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NetworkAdjacentLocalPhysical
Attack Complexity
LowHigh
Privileges Required
NoneLowHigh
User Interaction
NoneRequired
Scope
ChangedUnchanged
Confidentiality Impact
HighLowNone
Integrity Impact
HighLowNone
Availability Impact
HighLowNone

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxfb7d3bc4149395c1ae99029c852eab6c28fc3c88, fb7d3bc4149395c1ae99029c852eab6c28fc3c88, fb7d3bc4149395c1ae99029c852eab6c28fc3c88, fb7d3bc4149395c1ae99029c852eab6c28fc3c88unaffected
LinuxLinux6.14, 0, 6.18.27, 6.19.14, 7.0.1, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.