Log in Start free

Vulnerability · Published Apr 22, 2026 · Assigned by Linux

CVE-2026-31454xfs: save ailp before dropping the AIL lock in push callbacks

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.1%top 97.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: xfs: save ailp before dropping the AIL lock in push callbacks In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock is dropped to perform buffer IO. Once the cluster buffer no longer protects the log item from reclaim, the log item may be freed by background reclaim or the dquot shrinker. The subsequent spin_lock() call dereferences lip->li_ailp, which is a use-after-free. Fix this by saving the ailp pointer in a local variable while the AIL lock is held and the log item is guaranteed to be valid.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.170-1DEBIAN-CVE-2026-31454
Debian:13linux6.12.85-1DEBIAN-CVE-2026-31454
Debian:14linux6.19.11-1DEBIAN-CVE-2026-31454
Ubuntu:22.04:LTSlinux5.15.0-186.196UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux6.8.0-136.136UBUNTU-CVE-2026-31454
Ubuntu:25.10linuxno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-aws5.15.0-1112.119UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-aws6.8.0-1061.64UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-awsno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1061.64~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure5.15.0-1117.126UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure6.8.0-1063.71UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-azureno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1063.71~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1117.126UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1062.69UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1062.69~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gcp5.15.0-1112.122UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gcp6.8.0-1064.72UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-gcpno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1064.72~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gke5.15.0-1108.114UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gke6.8.0-1059.67UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1095.103UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1046.50UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-136.136~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-ibm5.15.0-1106.110UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-ibm6.8.0-1061.62UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1061.62~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1107.113UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-kvm5.15.0-1104.109UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-184.194UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-136.136.2UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-136.136.2~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1107.108UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1059.62UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1059.62~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1059.62.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1064.66UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1030.31UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1053.53UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oracle5.15.0-1109.115UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oracle6.8.0-1058.61UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-oracleno fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1058.61~22.04.1UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-raspi5.15.0-1106.109UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-raspi6.8.0-1061.65UBUNTU-CVE-2026-31454
Ubuntu:25.10linux-raspino fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:25.10linux-realtimeno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-31454
Ubuntu:25.10linux-riscvno fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-136.136~22.04.3UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-vmware6.8.0-1008.8UBUNTU-CVE-2026-31454
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1033.34UBUNTU-CVE-2026-31454
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1075.79UBUNTU-CVE-2026-31454

Affected products (as reported)

VendorProductVersions
Linux Linux 90c60e16401248a4900f3f9387f563d0178dcf34 – before edd1637d4e3911ab6c760f553f2040fe72f61a1390c60e16401248a4900f3f9387f563d0178dcf34 – before 19437e4f7bb909afde832b39372aa2f3ce3cfd8890c60e16401248a4900f3f9387f563d0178dcf34 – before 6dbe17f19c290a72ce57d5abc70e1fad0c3e14e590c60e16401248a4900f3f9387f563d0178dcf34 – before 75669e987137f49c99ca44406bf0200d1892dd1690c60e16401248a4900f3f9387f563d0178dcf34 – before d8fc60bbaf5aea1604bf9f4ed565da6a1ac7a87d90c60e16401248a4900f3f9387f563d0178dcf34 – before 50f5f056807b7bed74f4f307f2ca0ed92f3e556d90c60e16401248a4900f3f9387f563d0178dcf34 – before 4c7d50147316cf049462f327c4a3e9dc2b7f1dd090c60e16401248a4900f3f9387f563d0178dcf34 – before 394d70b86fae9fe865e7e6d9540b7696f73aa9b6
Linux Linux 5.9

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References