CVE-2026-23109

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23109", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.967Z", "datePublished": "2026-02-04T16:08:29.468Z", "dateUpdated": "2026-05-11T22:00:17.858Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:00:17.858Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()\n\nAbove the while() loop in wait_sb_inodes(), we document that we must wait\nfor all pages under writeback for data integrity. Consequently, if a\nmapping, like fuse, traditionally does not have data integrity semantics,\nthere is no need to wait at all; we can simply skip these inodes.\n\nThis restores fuse back to prior behavior where syncs are no-ops. This\nfixes a user regression where if a system is running a faulty fuse server\nthat does not reply to issued write requests, this causes wait_sb_inodes()\nto wait forever."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "include/linux/pagemap.h"], "versions": [{"version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "lessThan": "3f4ed5e2b8f111553562507ad6202432c7c57731", "status": "affected", "versionType": "git"}, {"version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "lessThan": "f9a49aa302a05e91ca01f69031cb79a0ea33031f", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "include/linux/pagemap.h"], "versions": [{"version": "6.16", "status": "affected"}, {"version": "0", "lessThan": "6.16", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.8", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.18.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.16", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/3f4ed5e2b8f111553562507ad6202432c7c57731"}, {"url": "https://git.kernel.org/stable/c/f9a49aa302a05e91ca01f69031cb79a0ea33031f"}], "title": "fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "include/linux/pagemap.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "3f4ed5e2b8f111553562507ad6202432c7c57731", "status": "affected", "version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "versionType": "git"}, {"lessThan": "f9a49aa302a05e91ca01f69031cb79a0ea33031f", "status": "affected", "version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "include/linux/pagemap.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"lessThan": "6.16", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "467E1359-7F6A-4790-AC45-172024944460", "versionEndExcluding": "6.18.8", "versionStartIncluding": "6.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc6:*:*:*:*:*:*", "matchCriteriaId": "3EF854A1-ABB1-4E93-BE9A-44569EC76C0D", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()\n\nAbove the while() loop in wait_sb_inodes(), we document that we must wait\nfor all pages under writeback for data integrity. Consequently, if a\nmapping, like fuse, traditionally does not have data integrity semantics,\nthere is no need to wait at all; we can simply skip these inodes.\n\nThis restores fuse back to prior behavior where syncs are no-ops. This\nfixes a user regression where if a system is running a faulty fuse server\nthat does not reply to issued write requests, this causes wait_sb_inodes()\nto wait forever."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nfs/writeback: omitir los mapeos AS_NO_DATA_INTEGRITY en wait_sb_inodes()\n\nPor encima del bucle while() en wait_sb_inodes(), documentamos que debemos esperar por todas las p\u00e1ginas en proceso de escritura para la integridad de los datos. En consecuencia, si un mapeo, como fuse, tradicionalmente no tiene sem\u00e1ntica de integridad de datos, no hay necesidad de esperar en absoluto; podemos simplemente omitir estos inodos.\n\nEsto restaura fuse a su comportamiento anterior donde las sincronizaciones son no-ops. Esto corrige una regresi\u00f3n de usuario donde si un sistema est\u00e1 ejecutando un servidor fuse defectuoso que no responde a las solicitudes de escritura emitidas, esto hace que wait_sb_inodes() espere indefinidamente."}], "id": "CVE-2026-23109", "lastModified": "2026-06-17T10:20:54.607", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-02-04T17:16:21.783", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3f4ed5e2b8f111553562507ad6202432c7c57731"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/f9a49aa302a05e91ca01f69031cb79a0ea33031f"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-835"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: fs/writeback: skip AS_NO_DATA_INTEGRITY mappings in wait_sb_inodes()", "id": "2436782", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2436782"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23109", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-02-04T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23109\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23109\nhttps://lore.kernel.org/linux-cve-announce/2026020431-CVE-2026-23109-3e57@gregkh/T"], "threat_severity": "Moderate"}

{"analysis": {"en": {"generated_at": "2026-04-17T23:30:03.544149+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a patched version (for example 6.19 rc7 or later) or apply the upstream source fix for wait_sb_inodes().", "If a kernel upgrade cannot be performed immediately, unmount or avoid mounting suspicious FUSE filesystems until the patch is applied, or use sync options that skip sync on those mounts.", "Verify that any FUSE server you rely on responds to write requests; add health checks or enforce timeouts in the client.", "Monitor system logs for prolonged sync activity and set alerts on excessive wait times."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "This issue is present in the Linux kernel starting from the 6.19 release candidates through rc6, as indicated by the CPE strings. Any kernel build that incorporates the unchanged writeback code is vulnerable, and upstream stable kernels that eventually receive the patch will also be affected. No specific distribution names were supplied, so all Linux kernel installations that have not applied the fix are at risk.", "description_and_impact": "A bug in the Linux kernel\u2019s writeback logic causes the wait_sb_inodes() function to skip data\u2011integrity checks for filesystems that do not provide them, such as FUSE mounts. When a FUSE server fails to acknowledge write requests, the waiting loop can block indefinitely, resulting in a denial\u2011of\u2011service condition that stalls sync operations and can leave higher\u2011level processes hanging. The weakness is identified as CWE\u2011835.", "risk_and_exploitability": "The CVSS score of 5.5 places the vulnerability in the medium severity range. The EPSS score of less than 1\u202f% suggests a low chance of exploitation, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires a faulty or malicious FUSE server that the target system mounts, making the attack vector local or remote to the mount point. While the impact is limited to the host executing sync operations, it can lead to resource starvation or a hung system, but does not grant privilege escalation or data theft."}}}}, "created": "2026-04-17T23:30:15.921848+00:00", "updated": "2026-04-17T23:30:15.921859+00:00", "vendors": []}