{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-31467", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.097Z", "datePublished": "2026-04-22T13:53:56.910Z", "dateUpdated": "2026-08-05T12:22:46.421Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:22:46.421Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: add GFP_NOIO in the bio completion if needed\n\nThe bio completion path in the process context (e.g. dm-verity)\nwill directly call into decompression rather than trigger another\nworkqueue context for minimal scheduling latencies, which can\nthen call vm_map_ram() with GFP_KERNEL.\n\nDue to insufficient memory, vm_map_ram() may generate memory\nswapping I/O, which can cause submit_bio_wait to deadlock\nin some scenarios.\n\nTrimmed down the call stack, as follows:\n\nf2fs_submit_read_io\n submit_bio //bio_list is initialized.\n mmc_blk_mq_recovery\n z_erofs_endio\n vm_map_ram\n __pte_alloc_kernel\n __alloc_pages_direct_reclaim\n shrink_folio_list\n __swap_writepage\n submit_bio_wait //bio_list is non-NULL, hang!!!\n\nUse memalloc_noio_{save,restore}() to wrap up this path." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:N - EROFS is exportable and remote NFS clients can cause kernel VFS reads of exported compressed EROFS files, reaching the same compressed read and bio completion path without local code execution. Scoring the highest reasonable deployment therefore uses Network.\nAC:L - Given a target using compressed EROFS with process-context bio completions such as dm-verity, the attacker can repeatedly issue reads and create memory pressure to drive vm_map_ram() into reclaim. No attacker-uncontrolled race or precise memory layout is required.\nPR:N - In the network-export scenario, an unauthenticated or anonymous read-only NFS client can trigger READ operations that run in kernel nfsd context. EROFS itself adds no privilege gate beyond normal export and file read permissions.\nUI:N - The attacker can trigger the vulnerable path by issuing read requests; no victim user action is required.\nS:U - The deadlock occurs within the kernel filesystem, block I/O, and memory reclaim paths of the same system security authority. It does not cross a VM, IOMMU, or other separate security boundary.\nC:N - The bug is an allocation-context deadlock caused by reclaim issuing swap I/O while current->bio_list is active. It does not expose kernel memory or provide a read primitive.\nI:N - The fix only prevents I/O-generating reclaim during decompression, and the vulnerable behavior is a hang rather than memory corruption. There is no data modification or control-flow hijack primitive.\nA:H - The failure mode is a deadlock in submit_bio_wait with bios queued behind an active submit_bio path, which can hang I/O/reclaim and render the system or service unavailable. Kernel deadlocks are high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zdata.c" ], "versions": [ { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "d6565ea662e17d45a577184b0011bd69de22dc2b", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "d9d8360cb66e3b599d89d2526e7da8b530ebf2ff", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "378949f46e897204384f3f5f91e42e93e3f87568", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "da40464064599eefe78749f75cd2bba371044c04", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "e83e20b82859f0588e9a52a6fa9fea704a2061cf", "status": "affected", "versionType": "git" }, { "version": "648f2de053a882c87c05f0060f47d3b11841fdbe", "lessThan": "c23df30915f83e7257c8625b690a1cece94142a0", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/zdata.c" ], "versions": [ { "version": "5.13", "status": "affected" }, { "version": "0", "lessThan": "5.13", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.203", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.168", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.131", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "5.15.203" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.1.168" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.6.131" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.12.80" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.18.21" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "6.19.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.13", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/d6565ea662e17d45a577184b0011bd69de22dc2b" }, { "url": "https://git.kernel.org/stable/c/d9d8360cb66e3b599d89d2526e7da8b530ebf2ff" }, { "url": "https://git.kernel.org/stable/c/5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902" }, { "url": "https://git.kernel.org/stable/c/378949f46e897204384f3f5f91e42e93e3f87568" }, { "url": "https://git.kernel.org/stable/c/da40464064599eefe78749f75cd2bba371044c04" }, { "url": "https://git.kernel.org/stable/c/e83e20b82859f0588e9a52a6fa9fea704a2061cf" }, { "url": "https://git.kernel.org/stable/c/c23df30915f83e7257c8625b690a1cece94142a0" } ], "title": "erofs: add GFP_NOIO in the bio completion if needed", "x_generator": { "engine": "bippy-1.2.0" } } } }