PT-2026-20450 · Linux · Linux Kernel

Published 2026-01-01 · Updated 2026-03-25 · CVE-2026-23224

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The EROFS filesystem may experience a use-after-free (UAF) condition when a file-backed mount with the directio option is enabled. This can lead to a system panic. The issue arises from a race condition where a bio structure is freed while still being accessed, specifically within the file accessed() function. The vulnerability occurs during the completion of an I/O operation, where a reference count is introduced in the erofs fileio rq structure to manage the lifecycle of the request. The erofs fileio ki complete() and erofs fileio rq submit() functions decrement this reference count, and the request is freed when the count reaches zero.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-23224

ECHO-92FE-4D80-CE75

OPENSUSE-SU-2026:10387-1

OPENSUSE-SU-2026:20416-1

SUSE-SU-2026:20838-1

SUSE-SU-2026:20931-1

SUSE-SU-2026:21284-1

Affected Products

Linux Kernel

References · 419

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23224.json · Exploit
• https://osv.dev/vulnerability/SUSE-SU-2026:20838-1 · Vendor Advisory
• https://git.kernel.org/stable/c/1caf50ce4af096d0280d59a31abdd85703cd995c · Patch
• https://git.kernel.org/stable/c/b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa · Patch
• https://linux.oracle.com/errata/ELSA-2026-50160.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23224 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-12-CVE-2026-23224 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23224 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-23224 · Security Note
• https://osv.dev/vulnerability/ROOT-OS-DEBIAN-11-CVE-2026-23224 · Vendor Advisory
• https://git.kernel.org/stable/c/ae385826840a3c8e09bf38cac90adcd690716f57 · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10387-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20931-1 · Vendor Advisory
• https://osv.dev/vulnerability/BELL-CVE-2026-23224 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20416-1 · Vendor Advisory