LiveActive security incident?Get immediate response
CVE Record

CVE-2026-31715: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io()

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix UAF caused by decrementing sbi->nr_pages[] in f2fs_write_end_io() The xfstests case "generic/107" and syzbot have both reported a NULL pointer dereference. The concurrent scenario that triggers the panic is as follows: F2FS_WB_CP_DATA write callback umount - f2fs_write_checkpoint - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA) - blk_mq_end_request - bio_endio - f2fs_write_end_io : dec_page_count(sbi, F2FS_WB_CP_DATA) : wake_up(&sbi->cp_wait) - kill_f2fs_super - kill_block_super - f2fs_put_super : iput(sbi->node_inode) : sbi->node_inode = NULL : f2fs_in_warm_node_list - is_node_folio // sbi->node_inode is NULL and panic The root cause is that f2fs_put_super() calls iput(sbi->node_inode) and sets sbi->node_inode to NULL after sbi->nr_pages[F2FS_WB_CP_DATA] is decremented to zero. As a result, f2fs_in_warm_node_list() may dereference a NULL node_inode when checking whether a folio belongs to the node inode, leading to a panic. This patch fixes the issue by calling f2fs_in_warm_node_list() before decrementing sbi->nr_pages[F2FS_WB_CP_DATA], thus preventing the use-after-free condition.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2026-31715 is a Linux kernel F2FS filesystem bug that can crash the kernel during a race between write completion and unmount. The source describes a panic, not data theft or remote takeover. Business impact is availability risk on systems using F2FS.

Executive priority

Treat as a targeted availability issue. It is most urgent for fleets using F2FS on production or embedded systems where a kernel panic causes service disruption.

Technical view

The bug is in F2FS write-end I/O handling. During unmount, f2fs_put_super() can clear sbi->node_inode after F2FS_WB_CP_DATA page accounting reaches zero, while f2fs_write_end_io() later calls f2fs_in_warm_node_list() and dereferences the cleared inode. Stable patches reorder the warm-node-list check before decrementing the page counter.

Likely exposure

Exposure appears limited to Linux systems running affected kernels with F2FS in use. The CVE lists Linux affected versions but does not provide distribution-specific package mappings or complete deployment guidance.

Exploitation context

The source cites xfstests generic/107 and syzbot reports causing a NULL pointer dereference. KEV is false, and the bundle provides no evidence of active exploitation or public weaponization.

Researcher notes

Evidence supports a concurrency bug in F2FS cleanup and writeback completion. The source identifies the fix pattern and trigger reports, but lacks CVSS, CWE, exploitability analysis, and distro package status.

Mitigation direction

  • Update to a kernel containing the referenced stable F2FS fixes.
  • Check Linux distribution advisories for fixed kernel package versions.
  • Prioritize systems that mount or depend on F2FS volumes.
  • Track vendor guidance if using custom or embedded kernels.

Validation and detection

  • Inventory hosts and devices using F2FS filesystems.
  • Compare running kernel builds against vendor fixed versions.
  • Confirm the relevant stable patch is present in custom kernels.
  • Review crash logs for F2FS NULL pointer dereference panics.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-31715 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
6Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux50fa53eccf9f911a5b435248a2b0bd484fd82e5e, 50fa53eccf9f911a5b435248a2b0bd484fd82e5e, 50fa53eccf9f911a5b435248a2b0bd484fd82e5e, 50fa53eccf9f911a5b435248a2b0bd484fd82e5e, 50fa53eccf9f911a5b435248a2b0bd484fd82e5eunaffected
LinuxLinux4.19, 0, 6.6.140, 6.12.86, 6.18.25, 7.0.2, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.