Junglewise Threat Intelligence

CVE-2026-31597: Linux kernel use-after-free in OCFS2 ocfs2_fault

CVE-2026-31597 · Severity: high · CVSS 7.8 · Published 2026-04-24

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's OCFS2 file system, which is used for managing shared storage in clustered environments. A flaw in how the system handles memory faults could allow a local user to trigger a 'use-after-free' condition, potentially leading to a system crash or unauthorized access to sensitive kernel memory. This could impact the stability and security of servers using this specific file system.

Technical details

A use-after-free vulnerability exists in the ocfs2_fault() function within the OCFS2 file system implementation of the Linux kernel. The root cause is that filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY. If this occurs, a concurrent munmap() operation can free the vm_area_struct (VMA) via RCU. The subsequent call to trace_ocfs2_fault() then dereferences the now-dangling 'vma' pointer. An attacker with local access could exploit this race condition to cause a kernel panic or potentially achieve arbitrary code execution. The fix involves caching the required inode information (ip_blkno) as a value before calling filemap_fault() and removing the VMA reference from the trace event.

Affected products

  • Linux Linux kernel 2.6.39 to 6.6.136, 6.7 to 6.12.83, 6.13 to 6.18.24, 6.19 to 6.19.14, 7.0 to 7.0.1

Timeline

  • 2026-04-10: other: Patch submitted by developer Tejas Bharambe
  • 2026-04-24: disclosed: CVE published
  • 2026-04-29: other: NIST initial analysis completed
  • 2026-06-01: patched: Patch committed to stable tree by Greg Kroah-Hartman

References