In the Linux kernel, the following vulnerability has been resolved:
ext4: fix use-after-free in update_super_work when racing with umount
Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount
filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work
to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups
reads during unmount. However, this introduced a use-after-free because
update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which
accesses the kobject's kernfs_node after it has been freed by kobject_del()
in ext4_unregister_sysfs():
update_super_work ext4_put_super
----------------- --------------
ext4_unregister_sysfs(sb)
kobject_del(&sbi->s_kobj)
__kobject_del()
sysfs_remove_dir()
kobj->sd = NULL
sysfs_put(sd)
kernfs_put() // RCU free
ext4_notify_error_sysfs(sbi)
sysfs_notify(&sbi->s_kobj)
kn = kobj->sd // stale pointer
kernfs_get(kn) // UAF on freed kernfs_node
ext4_journal_destroy()
flush_work(&sbi->s_sb_upd_work)
Instead of reordering the teardown sequence, fix this by making
ext4_notify_error_sysfs() detect that sysfs has already been torn down
by checking s_kobj.state_in_sysfs, and skipping the sysfs_notify() call
in that case. A dedicated mutex (s_error_notify_mutex) serializes
ext4_notify_error_sysfs() against kobject_del() in ext4_unregister_sysfs()
to prevent TOCTOU races where the kobject could be deleted between the
state_in_sysfs check and the sysfs_notify() call.
References
Configurations
Configuration 1 (hide)
|
History
07 May 2026, 19:21
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:o:linux:linux_kernel:5.18:rc9:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:-:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc4:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:5.18:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
|
| First Time |
Linux linux Kernel
Linux |
|
| References | () https://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e - Patch | |
| References | () https://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93 - Patch | |
| References | () https://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d - Patch | |
| References | () https://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff - Patch | |
| References | () https://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3 - Patch | |
| References | () https://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe - Patch | |
| References | () https://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697 - Patch | |
| CWE | CWE-416 |
27 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.8 |
22 Apr 2026, 14:16
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2026-04-22 14:16
Updated : 2026-05-07 19:21
NVD link : CVE-2026-31446
Mitre link : CVE-2026-31446
CVE.ORG link : CVE-2026-31446
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-416
Use After Free