Executive brief
A vulnerability exists in the Linux kernel's ext4 filesystem driver that can lead to a system crash or unpredictable behavior. The issue occurs when the system attempts to unmount a disk while background error-reporting tasks are still running, causing the software to access memory that has already been released. This could potentially be exploited to disrupt system operations or gain unauthorized access on affected devices, including certain industrial controllers.
Technical details
A use-after-free (UAF) vulnerability exists in the ext4 filesystem component of the Linux kernel due to a race condition between 'update_super_work' and 'ext4_put_super' during a filesystem unmount. The root cause is that 'ext4_unregister_sysfs()' is called before flushing 's_sb_upd_work', leading 'ext4_notify_error_sysfs()' to invoke 'sysfs_notify()' on a kobject whose 'kernfs_node' has already been freed. An attacker with local access could potentially exploit this race condition to cause a kernel panic or achieve arbitrary code execution. The fix introduces 's_error_notify_mutex' to serialize sysfs notification checks against kobject deletion.
Affected products
- Linux Linux Kernel ext4 filesystem component
- Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5, V3.1.6
Timeline
- 2026-03-19: patched: Initial patch submitted by Jiayuan Chen
- 2026-04-22: disclosed: CVE-2026-31446 published
References
- https://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e
- https://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93
- https://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d
- https://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff
- https://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3
- https://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe
- https://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697