PT-2026-36332 · Linux · Linux Kernel

Published 2026-05-01 · Updated 2026-05-19 · CVE-2026-31702

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A use-after-free issue exists in the f2fs compress write end io() function. The dec page count(sbi, type) function can reduce the F2FS WB CP DATA counter to zero, which may unblock f2fs wait on all pages() within f2fs put super() on a concurrent unmount CPU. This allows the unmount process to execute f2fs destroy page array cache(sbi), destroying the sbi->page array slab via kmem cache destroy() and eventually freeing sbi via kfree(sbi). If the bio completion callback is still executing, it may dereference the destroyed sbi->page array slab when calling page array free(sbi, ...), leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-31702

ECHO-38CB-6B78-B0A9

OPENSUSE-SU-2026:10793-1

Affected Products

Linux Kernel

References · 51

• https://security-tracker.debian.org/tracker/CVE-2026-31702 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-31702 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31702 · Vendor Advisory
• https://git.kernel.org/stable/c/f5154cf3ce1c8193f0c1891d3769f62740cfe6fe · Patch
• https://git.kernel.org/stable/c/2c97dcb6147c8f7f25c629b93be1e69617de5d4a · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2026:10793-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-31702 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31702 · Security Note
• https://git.kernel.org/stable/c/ef57cd3329b40c739b9a2e1a8a21ecc4171c6280 · Patch
• https://git.kernel.org/stable/c/39d4ee19c1e7d753dd655aebee632271b171f43a · Patch
• https://git.kernel.org/stable/c/c76cf339b87975ae5b2c06d2d774d5667d25a12a · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31702 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-31702 · Vendor Advisory
• https://suse.com/security/cve/CVE-2026-31715 · Note
• https://suse.com/security/cve/CVE-2026-31705 · Note