Linux: Use After Free
CVE-2026-31446 is a high-severity use after free vulnerability in Linux, with a CVSS 3.1 base score of 7.8 out of 10. It can be exploited with local access to the system by an unauthenticated attacker, but only if a user takes part, for example by opening a link or file. The record lists versions c8fe17a1b308c3d8c703ebfb049b325f844342c3, c4d829737329f2290dd41e290b7d75effdb2a7ff, 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.14% chance of exploitation within 30 days, which is low compared with other CVEs.
High severity with no evidence of exploitation so far.
What to do
- Update Linux to c8fe17a1b308c3d8c703ebfb049b325f844342c3 or c4d829737329f2290dd41e290b7d75effdb2a7ff or 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d or 034053378dd81837fd6c7a43b37ee2e58d4f0b4e, whichever matches your release line, or a later version.
- Update Linux Kernel to 5.11 or 5.15.203 or 5.18 or 6.1.168, whichever matches your release line, or a later version.
- Because the attack needs a user to take part, warn users about unexpected links and files related to this product until it is patched.
Affected products and versions
| Vendor | Product | Affected versions | Fixed in |
|---|---|---|---|
| Linux | Linux | 52c3a04f9ec2a16a4204d6274db338cb8d5b2d74 up to, but not including, c8fe17a1b308c3d8c703ebfb049b325f844342c3; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, c4d829737329f2290dd41e290b7d75effdb2a7ff; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, 034053378dd81837fd6c7a43b37ee2e58d4f0b4e; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, 08b10e6f37fc533a759e9833af0692242e8b3f93; b98535d091795a79336f520b0708457aacf55c67 up to, but not including, d15e4b0a418537aafa56b2cb80d44add83e83697; 585ef03c9e79672781f954daae730dfe24bf3a46; and 5 more ranges | c8fe17a1b308c3d8c703ebfb049b325f844342c3, c4d829737329f2290dd41e290b7d75effdb2a7ff, 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d, 034053378dd81837fd6c7a43b37ee2e58d4f0b4e, c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe, 08b10e6f37fc533a759e9833af0692242e8b3f93 |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Siemens | SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) | V3.1.6 and later; V3.1.5 and later; V3.1.7 and later | Not stated |
| Linux | Linux Kernel | 5.10.114 up to, but not including, 5.11; 5.15.38 up to, but not including, 5.15.203; 5.17.6 up to, but not including, 5.18; 5.18.1 up to, but not including, 6.1.168; 6.2 up to, but not including, 6.6.131; 6.7 up to, but not including, 6.12.80; 6.13 up to, but not including, 6.18.21; 6.19 up to, but not including, 6.19.11; and 2 more ranges | 5.11, 5.15.203, 5.18, 6.1.168, 6.6.131, 6.12.80 |
Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.
How the severity score breaks down
- Attack vector
- LocalThe attacker needs local access or must trick a user into running something.
- Attack complexity
- LowNo special conditions are needed; the attack works reliably.
- Privileges required
- NoneNo account or login is needed.
- User interaction
- RequiredA user must take an action such as opening a file or link.
- Scope
- UnchangedImpact stays within the vulnerable component.
- Confidentiality
- HighAll data handled by the component can be read.
- Integrity
- HighData or code can be modified at will.
- Availability
- HighThe component can be taken down completely.
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Scored by CNA.
Official description
In the Linux kernel, the following vulnerability has been resolved: ext4: fix use-after-free in update_super_work when racing with umount Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups reads during unmount. However, this introduced a use-after-free because update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which accesses the kobject's kernfs_node after it has been freed by kobject_del() in ext4_unregister_sysfs(): update_super_work ext4_put_super ----------------- -------------- ext4_unregister_sysfs(sb) kobject_del(&sbi->s_kobj) __kobject_del() sysfs_remove_dir() kobj->sd = NULL sysfs_put(sd) kernfs_put() // RCU free ext4_notify_error_sysfs(sbi) sysfs_notify(&sbi->s_kobj) kn = kobj->sd // stale pointer kernfs_get(kn) // UAF on freed kernfs_node ext4_journal_destroy() flush_work(&sbi->s_sb_upd_work) Instead of reordering the teardown sequence, fix this by making ext4_notify_error_sysfs() detect that sysfs has already been torn down by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call in that case. A dedicated mutex (s_error_notify_mutex) serializes ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs() to prevent TOCTOU races where the kobject could be deleted between the state_in_sysfs check and the sysfs_notify() call.
Source: the CVE record as published by its numbering authority, via NVD and CVE.org.
The underlying weakness: Use After Free
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory belongs to the code that operates on the new pointer.
How developers prevent this class of flaw
- Choose a language that provides automatic memory management.
- When freeing pointers, be sure to set them to NULL once they are freed. However, the utilization of multiple or complex data structures may lower the usefulness of this strategy.
Timeline
- CVE record published.
- CISA published its SSVC assessment (exploitation: none, automatable: no, technical impact: total).
- Record last changed materially (score, affected products, status or references).
References
Patches and release notes
- git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e
- git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93
- git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d
- git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff
- git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3
- git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe
- git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697
Other references
Recent Use After Free vulnerabilities
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 7.8 High severity
- 9.8 Critical severity
- 7.8 High severity
Spotted an error? Tell us.