CVE-2026-31514

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31514", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.107Z", "datePublished": "2026-04-22T13:54:31.531Z", "dateUpdated": "2026-10-23T08:20:15.576Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-23T08:20:15.576Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/fileio.c"], "versions": [{"version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "lessThan": "d1ba7d6b3cd1757b108d7b6856c92ae661d6c323", "status": "affected", "versionType": "git"}, {"version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "lessThan": "5cf3972c8221abdb1b464a14ccf8103d840b9085", "status": "affected", "versionType": "git"}, {"version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "lessThan": "5a5f23ef5431639db1ac3a0b274aef3a84cc413c", "status": "affected", "versionType": "git"}, {"version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "lessThan": "eade54040384f54b7fb330e4b0975c5734850b3c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/fileio.c"], "versions": [{"version": "6.12", "status": "affected"}, {"version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.80", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.21", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.11", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"}, {"url": "https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"}, {"url": "https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"}, {"url": "https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}], "title": "erofs: set fileio bio failed in short read case", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["fs/erofs/fileio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "d1ba7d6b3cd1757b108d7b6856c92ae661d6c323", "status": "affected", "version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "versionType": "git"}, {"lessThan": "5cf3972c8221abdb1b464a14ccf8103d840b9085", "status": "affected", "version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "versionType": "git"}, {"lessThan": "5a5f23ef5431639db1ac3a0b274aef3a84cc413c", "status": "affected", "version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "versionType": "git"}, {"lessThan": "eade54040384f54b7fb330e4b0975c5734850b3c", "status": "affected", "version": "ce63cb62d794c98c7631c2296fa845f2a8d0a4a1", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["fs/erofs/fileio.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.12"}, {"lessThan": "6.12", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.80", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.21", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086", "versionEndExcluding": "6.12.80", "versionStartIncluding": "6.12.75", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DEA57E4E-36B0-40D5-98B9-6A50348C9E74", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.18.14", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A67B0458-DAE3-4940-BBB2-1A4D263AF27B", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19.4", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nerofs: establecer que el bio de fileio fall\u00f3 en caso de lectura corta\n\nPara montajes respaldados por archivos, las solicitudes de E/S son manejadas por vfs_iocb_iter_read().\nSin embargo, puede ser interrumpido por SIGKILL, devolviendo el n\u00famero de bytes realmente copiados. Folios no utilizados en el bio son marcados inesperadamente como actualizados.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detectar se\u00f1al\n erofs_fileio_ki_complete <= establecer todos los folios como actualizados\n\nEste parche aborda esto al establecer el bio de lectura corta con un error directamente."}], "id": "CVE-2026-31514", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-04-22T14:16:50.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: erofs: set fileio bio failed in short read case", "id": "2460656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460656"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's erofs filesystem component. When an input/output (I/O) request for a file-backed mount is interrupted by a SIGKILL signal, the system incorrectly marks unused data blocks as up-to-date. This can lead to data integrity issues or the potential disclosure of stale or incorrect information to a local user."], "name": "CVE-2026-31514", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31514\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31514\nhttps://lore.kernel.org/linux-cve-announce/2026042209-CVE-2026-31514-510b@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8d582d65d20bb4796db01b19e86909ad68cb337b,d1ba7d6b3cd1757b108d7b6856c92ae661d6c323)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e49abde0ffc382a967b24f326d1614ac3bb06a94,5cf3972c8221abdb1b464a14ccf8103d840b9085)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe4039034dcdf584afbf763787909e28e92a4927,5a5f23ef5431639db1ac3a0b274aef3a84cc413c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc,eade54040384f54b7fb330e4b0975c5734850b3c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.75,6.12.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.14,6.18.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.4,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-29T03:50:32.612782+00:00", "value": {"mitigation_remediation": ["Apply the kernel patch that implements the short\u2011read bio error handling as referenced in the commit URLs.", "Restrict the users who can mount file\u2011backed erofs filesystems to trusted accounts or isolate mounts within a restricted security context.", "If the patch is not yet available, mount the affected filesystem as read\u2011only or disable erofs support until the fix is applied."], "summary": {"action": "Patch", "impact": "Data Integrity"}, "threat_synthesis": {"affected_systems": "All Linux kernel releases that have not incorporated the recent erofs commit sequence are affected. The CVE data does not list specific kernel versions, so any kernel without those commits is at risk.", "description_and_impact": "The erofs filesystem in the Linux kernel contains a flaw that occurs when a file\u2011backed mount is read and the read operation is interrupted by a SIGKILL signal. In the error handling path, unused folios in the bio are incorrectly marked as up\u2011to\u2011date. As a result, the kernel may treat those pages as containing valid data even though they have not been fully read. This mis\u2011labeling can cause applications to read stale or uninitialized data, potentially leading to incorrect program behavior.", "risk_and_exploitability": "The CVSS score of 5.5 indicates moderate severity, while the EPSS score of less than 1% suggests a low probability of exploitation at the time of this analysis. The vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require a local user who can trigger a read on a file\u2011backed erofs filesystem and cause an interrupt; once the issue triggers, the user may observe incorrect data from the kernel. No evidence of remote code execution or denial of service is present in the available information."}}}}, "created": "2026-04-22T18:15:15.246177+00:00", "updated": "2026-04-29T04:00:13.093667+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}