CVE-2026-31580

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31580", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.119Z", "datePublished": "2026-04-24T14:42:10.874Z", "dateUpdated": "2026-11-05T21:45:09.216Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:06.405Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/bcache/super.c"], "versions": [{"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9", "status": "affected", "versionType": "git"}, {"version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/md/bcache/super.c"], "versions": [{"version": "3.10", "status": "affected"}, {"version": "0", "lessThan": "3.10", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.1", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.0.1"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "3.10", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"}, {"url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"}, {"url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"}, {"url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"}, {"url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"}, {"url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"}, {"url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"}, {"url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"}, {"url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"}], "title": "bcache: fix cached_dev.sb_bio use-after-free and crash", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:05.087Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:46.970760Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:45:09.216Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:17:05.087Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-31580", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:39:46.970760Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:39:48.527Z"}}], "cna": {"title": "bcache: fix cached_dev.sb_bio use-after-free and crash", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9", "versionType": "git"}, {"status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128", "versionType": "git"}], "programFiles": ["drivers/md/bcache/super.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"status": "unaffected", "version": "0", "lessThan": "3.10", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0.1", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/md/bcache/super.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"}, {"url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"}, {"url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"}, {"url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"}, {"url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"}, {"url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"}, {"url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"}, {"url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"}, {"url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.1", "versionStartIncluding": "3.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "3.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-06-14T17:42:06.405Z"}}}, "cveMetadata": {"cveId": "CVE-2026-31580", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:45:09.216Z", "dateReserved": "2026-03-09T15:48:24.119Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-04-24T14:42:10.874Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/md/bcache/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}, {"lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128", "status": "affected", "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/md/bcache/super.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "3.10"}, {"lessThan": "3.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.1", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "14109CEF-714B-4029-A318-97AA58A01833", "versionEndExcluding": "6.6.136", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A8BAD957-8E20-401C-A129-DFF3655CA0B7", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.12", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9B5888AB-7403-4335-89E4-21CC0B48366A", "versionEndExcluding": "7.0.1", "versionStartIncluding": "7.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime. If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nbcache: corrige el uso despu\u00e9s de liberaci\u00f3n de cached_dev.sb_bio y la ca\u00edda\n\nEn nuestro entorno de producci\u00f3n, hemos recibido m\u00faltiples informes de ca\u00eddas relacionados con libceph, que han llamado nuestra atenci\u00f3n:\n\n\u201d\u201d\u201c\n[6888366.280350] Call Trace:\n[6888366.280452] blk_update_request+0x14e/0x370\n[6888366.280561] blk_mq_end_request+0x1a/0x130\n[6888366.280671] rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792] rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903] __complete_request+0x22/0x70 [libceph]\n[6888366.281032] osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164] ? inet_recvmsg+0x5b/0xd0\n[6888366.281272] ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405] ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534] ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661] ceph_con_workfn+0x329/0x680 [libceph]\n\u201d\u201d\u201d\n\nDespu\u00e9s de analizar el archivo coredump, encontramos que la direcci\u00f3n de dc -> sb_bio ha sido liberada. Sabemos que cached_dev solo se libera cuando se detiene.\n\nDado que sb_bio es parte de la estructura cached_dev, en lugar de una asignaci\u00f3n cada vez. Si el dispositivo se detiene mientras se escribe en el superbloque, la direcci\u00f3n liberada ser\u00e1 accedida en endio.\n\nEste parche espera a que sb_write se complete en cached_dev_free.\n\nCabe se\u00f1alar que analizamos la causa del problema, luego contamos todos los detalles a QWEN y adoptamos las modificaciones que realiz\u00f3."}], "id": "CVE-2026-31580", "lastModified": "2026-11-11T23:10:00.263", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-31580", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:39:46.970760Z", "version": "2.0.3"}}]}, "published": "2026-04-24T15:16:32.683", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2d6965581e164fa2ba3f7652ddae5535f6336576"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4f71c8ba2dc009042493021d94a9718fbe2ebf27"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/81f44ed8c3f54abb7561ece774ea4cca5070b2f2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/add4982510f3b7c318a2dd7438bdc9c63171e753"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f50e7c325ab1207fe941555bcff659f6d7050572"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fec114a98b8735ee89c75216c45a78e28be0f128"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-416"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: bcache: fix cached_dev.sb_bio use-after-free and crash", "id": "2461464", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2461464"}, "csaw": false, "cwe": "CWE-367", "details": ["A flaw was found in the Linux kernel's bcache component. This use-after-free vulnerability occurs when a cached device is stopped while an I/O operation, specifically writing to the superblock, is still in progress. This timing issue can lead to the system attempting to access memory that has already been freed, resulting in a system crash and a Denial of Service (DoS)."], "name": "CVE-2026-31580", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-24T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31580\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31580\nhttps://lore.kernel.org/linux-cve-announce/2026042411-CVE-2026-31580-7d94@gregkh/T"]}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,add4982510f3b7c318a2dd7438bdc9c63171e753)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,2d6965581e164fa2ba3f7652ddae5535f6336576)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,4f71c8ba2dc009042493021d94a9718fbe2ebf27)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[cafe563591446cf80bfbc2fe3bc72a2e36cf1060,fec114a98b8735ee89c75216c45a78e28be0f128)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "3.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,3.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.136,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.83,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.1,8.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.24,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.19.14,7.0.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-28T14:06:57.815560+00:00", "value": {"mitigation_remediation": ["Apply a kernel update that includes the bcache use\u2011after\u2011free fix (e.g., the patch series referenced in the advisory).", "If an immediate kernel upgrade is not possible, unload or disable the bcache module and refrain from booting it into the running system.", "Monitor system logs for occurrences of kernel panics or unexpected I/O failures, and enforce stricter device access controls to limit who can manipulate bcache devices."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "All Linux kernel implementations that include the bcache module and are running versions prior to the patch that introduced the safe free logic are affected. Both vendor and community kernels are susceptible, as the CNA list identifies the product simply as \"Linux: Linux\" and no specific version range is provided. Users of bcache on any recent kernel should verify whether the applied kernel contains the commit referenced in the advisory.", "description_and_impact": "The vulnerability is a use\u2011after\u2011free condition (CWE\u2011416, CWE\u2011367) in the bcache subsystem of the Linux kernel. When a bcache device is stopped while a superblock write is in progress, the cached_dev.sb_bio pointer is freed but later accessed during the I/O completion callback. The resulting memory corruption causes a kernel crash, which can terminate critical services.", "risk_and_exploitability": "The CVSS score of 7.8 indicates a high severity for instability. The EPSS score is reported as less than 1%, signalling that the probability of exploitation is low at this time and the vulnerability is not currently included in the CISA Known Exploited Vulnerabilities catalog. The likely attack vector is local, requiring the ability to stop a bcache device that is actively writing data. An attacker with local system access could attempt to trigger the crash, causing a denial of service."}}}}, "created": "2026-04-27T19:00:15.709693+00:00", "updated": "2026-04-28T14:15:34.907917+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}