Medium 5.5Published Apr 22, 2026

CVE-2026-31514erofs: set fileio bio failed in short read case

Updated under an hour ago (Oct 28, 2026, 1:50 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of bytes actually copied. Unused folios in bio are unexpectedly marked as uptodate. vfs_read filemap_read filemap_get_pages filemap_readahead erofs_fileio_readahead erofs_fileio_rq_submit vfs_iocb_iter_read filemap_read filemap_get_pages <= detect signal erofs_fileio_ki_complete <= set all folios uptodate This patch addresses this by setting short read bio with an error directly.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Oct 23, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before d1ba7d6b3cd1757b108d7b6856c92ae661d6c323; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before 5cf3972c8221abdb1b464a14ccf8103d840b9085; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before 5a5f23ef5431639db1ac3a0b274aef3a84cc413c; from ce63cb62d794c98c7631c2296fa845f2a8d0a4a1 before eade54040384f54b7fb330e4b0975c5734850b3c	CNA record
linux linux_kernel linux:linux_kernel	from 6.12.75 before 6.12.80; from 6.18.14 before 6.18.21; from 6.19.4 before 6.19.11	NVD

References

References

https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323	patch
https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085	patch
https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c	patch
https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.