CVE-2026-31467

Source
https://cve.org/CVERecord?id=CVE-2026-31467
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31467.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-31467
Downstream
Related
Published
2026-04-22T13:53:56.910Z
Modified
2026-06-18T03:55:56.938532530Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
erofs: add GFP_NOIO in the bio completion if needed
Details

In the Linux kernel, the following vulnerability has been resolved:

erofs: add GFP_NOIO in the bio completion if needed

The bio completion path in the process context (e.g. dm-verity) will directly call into decompression rather than trigger another workqueue context for minimal scheduling latencies, which can then call vmmapram() with GFP_KERNEL.

Due to insufficient memory, vmmapram() may generate memory swapping I/O, which can cause submitbiowait to deadlock in some scenarios.

Trimmed down the call stack, as follows:

f2fssubmitreadio submitbio //biolist is initialized. mmcblkmqrecovery zerofsendio vmmapram __pteallockernel __allocpagesdirectreclaim shrinkfolio_list __swapwritepage submitbiowait //biolist is non-NULL, hang!!!

Use memallocnoio{save,restore}() to wrap up this path.

Database specific
{
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/31xxx/CVE-2026-31467.json"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
648f2de053a882c87c05f0060f47d3b11841fdbe
Fixed
d6565ea662e17d45a577184b0011bd69de22dc2b
Fixed
d9d8360cb66e3b599d89d2526e7da8b530ebf2ff
Fixed
5c8ecdcfbfb0b0c6a82a4ebadc1ddea61609b902
Fixed
378949f46e897204384f3f5f91e42e93e3f87568
Fixed
da40464064599eefe78749f75cd2bba371044c04
Fixed
e83e20b82859f0588e9a52a6fa9fea704a2061cf
Fixed
c23df30915f83e7257c8625b690a1cece94142a0

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31467.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
5.13.0
Fixed
5.15.203
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.168
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.131
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.80
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.21
Type
ECOSYSTEM
Events
Introduced
6.19.0
Fixed
6.19.11

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-31467.json"