High 7.8Published Apr 24, 2026

CVE-2026-31597ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY

Updated under an hour ago (Oct 27, 2026, 3:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: ocfs2: fix use-after-free in ocfs2_fault() when VM_FAULT_RETRY filemap_fault() may drop the mmap_lock before returning VM_FAULT_RETRY, as documented in mm/filemap.c: "If our return value has VM_FAULT_RETRY set, it's because the mmap_lock may be dropped before doing I/O or by lock_folio_maybe_drop_mmap()." When this happens, a concurrent munmap() can call remove_vma() and free the vm_area_struct via RCU. The saved 'vma' pointer in ocfs2_fault() then becomes a dangling pointer, and the subsequent trace_ocfs2_fault() call dereferences it -- a use-after-free. Fix this by saving ip_blkno as a plain integer before calling filemap_fault(), and removing vma from the trace event. Since ip_blkno is copied by value before the lock can be dropped, it remains valid regardless of what happens to the vma or inode afterward.

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Aug 5, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 614a9e849ca6ea24843795251cb30af525d5336b before 36539c4d536f851a3b346a6ebb27b51bc3d77a94; 614a9e849ca6ea24843795251cb30af525d5336b builds before 35c2c05261d6f6d84aaa1355afa201d507943e76; 614a9e849ca6ea24843795251cb30af525d5336b builds before 3f5e74b5db9353b01ed50f4de84e75b755f8fbc2; 614a9e849ca6ea24843795251cb30af525d5336b builds before 6f072daefcab1d84ce37c073645615f63be91006; 614a9e849ca6ea24843795251cb30af525d5336b builds before 4cf2768a0291a0cdd0dae801ea0eafa3878a349d; from 614a9e849ca6ea24843795251cb30af525d5336b before d45ff441b416d4aa1af72b1db23d959601c04da2; 614a9e849ca6ea24843795251cb30af525d5336b builds before 76a602fdbb78dd05b2da06f74a988cebc97e82d0; from 614a9e849ca6ea24843795251cb30af525d5336b before 925bf22c1b823e231b1baea761fe8a1512e442f2; and 1 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 2.6.39 before 6.6.136; from 6.7 before 6.12.83; from 6.13 before 6.18.24; from 6.19 before 6.19.14; from 7.0 before 7.0.1	NVD

References

References

https://git.kernel.org/stable/c/36539c4d536f851a3b346a6ebb27b51bc3d77a94
https://git.kernel.org/stable/c/35c2c05261d6f6d84aaa1355afa201d507943e76
https://git.kernel.org/stable/c/3f5e74b5db9353b01ed50f4de84e75b755f8fbc2
https://git.kernel.org/stable/c/6f072daefcab1d84ce37c073645615f63be91006	patch
https://git.kernel.org/stable/c/4cf2768a0291a0cdd0dae801ea0eafa3878a349d	patch
https://git.kernel.org/stable/c/d45ff441b416d4aa1af72b1db23d959601c04da2	patch
https://git.kernel.org/stable/c/76a602fdbb78dd05b2da06f74a988cebc97e82d0	patch
https://git.kernel.org/stable/c/925bf22c1b823e231b1baea761fe8a1512e442f2	patch
https://git.kernel.org/stable/c/7de554cabf160e331e4442e2a9ad874ca9875921	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.