CVE-2026-31703

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

writeback: Fix use after free in inode_switch_wbs_work_fn()

inode_switch_wbs_work_fn() has a loop like:

wb_get(new_wb);

while (1) {

list = llist_del_all(&new_wb->switch_wbs_ctxs);

/* Nothing to do? */

if (!list)

break;

... process the items ...

}

Now adding of items to the list looks like:

wb_queue_isw()

if (llist_add(&isw->list, &wb->switch_wbs_ctxs))

queue_work(isw_wq, &wb->switch_work);

Because inode_switch_wbs_work_fn() loops when processing isw items, it

can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is

empty. This is a problem because in that case wb can get freed (no isw

items -> no wb reference) while the work is still pending causing

use-after-free issues.

We cannot just fix this by cancelling work when freeing wb because that

could still trigger problematic 0 -> 1 transitions on wb refcount due to

wb_get() in inode_switch_wbs_work_fn(). It could b

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References