Medium 5.5Published May 1, 2026

CVE-2026-31714f2fs: fix to avoid memory leak in f2fs_rename()

Updated under an hour ago (Oct 28, 2026, 7:00 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: f2fs: fix to avoid memory leak in f2fs_rename() syzbot reported a f2fs bug as below: BUG: memory leak unreferenced object 0xffff888127f70830 (size 16): comm "syz.0.23", pid 6144, jiffies 4294943712 hex dump (first 16 bytes): 3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff <.Wr[...n..3B9.. backtrace (crc 925f8a80): kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline] slab_post_alloc_hook mm/slub.c:4520 [inline] slab_alloc_node mm/slub.c:4844 [inline] __do_kmalloc_node mm/slub.c:5237 [inline] __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250 kmalloc_noprof include/linux/slab.h:954 [inline] fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364 f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143 f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961 f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308 vfs_rename+0x7ff/0x1250 fs/namei.c:6026 filename_renameat2+0x4f4/0x660 fs/namei.c:6144 __do_sys_renameat2 fs/namei.c:6173 [inline] __se_sys_renameat2 fs/namei.c:6168 [inline] __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f The root cause is in commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"), we added a call to f2fs_setup_filename() without a matching call to f2fs_free_filename(), fix it.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Jun 14, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 7525dec4b34c80b3015c3f2ac143fd2bfc1febc3 before a76c1cad4e80a9802ef8048662255417e3ce5b79; from 40b2d55e045222dd6de2a54a299f682e0f954b03 before c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e; from 40b2d55e045222dd6de2a54a299f682e0f954b03 before 047c0aef6af37a2a35181aa085c616ad286386f1; from 40b2d55e045222dd6de2a54a299f682e0f954b03 before 369eb2016d8e2f01931b3bad1cb9cefa83f44003; 40b2d55e045222dd6de2a54a299f682e0f954b03 builds before 3cf11e6f36c170050c12171dd6fd3142711478fc; 1d1b89c9846e6a550eca3d2ce9323fb591e4f321; 64582cc5357cd984724cfb0835b4a34d9c279d31; from 6.6.23 before 6.6.136; and 2 more ranges	CNA record
linux linux_kernel linux:linux_kernel	from 6.6.23 before 6.6.136; from 6.7.11 before 6.8; from 6.8.2 before 6.9; from 6.9 before 6.12.84; from 6.13 before 6.18.25; from 6.19 before 7.0.2; 7.1	NVD

References

References

https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79	patch
https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e	patch
https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1	patch
https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003	patch
https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.