Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-31586— mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm blk-cgroup中cgwb_release_workfn释放后重用，可能导致访问已释放blkcg。

CVSS 7.8 · High EPSS 0.18% · P7

Possible ATT&CK Techniques 1 AI

T1207 · Rogue Domain Controller

Affected Version Matrix 20

VendorProduct Version RangeStatus
Linux Linux 59b57717fff8b562825d9d25e0180ad7e8048ca9< 23acef4156c260e8598397a1a2e8b3a23e919893 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< 1bd36e93b542d9dd020190c6607c6a3663405195 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< 740ba1ebb223f137ff088ab74d533a13f9167bd8 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< 115a5266749dcde7fe4127e8623d19c752088f69 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< dfc8292a1d6782c76b626315605e0585a5a18447 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< ea3af09eb87d8f8708c66747fcf1a2762902e839 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< 50879a3c1faf06e661090015d59e2127255cff27 affected
59b57717fff8b562825d9d25e0180ad7e8048ca9< 67cb119d32f35e32acd0393bbeb318b2bb1fdafe affected
… +12 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-31586

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: mm: blk-cgroup: fix use-after-free in cgwb_release_workfn() cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last reference, the blkcg can be freed asynchronously (css_free_rwork_fn -> blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin, resulting in a use-after-free: BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531 Workqueue: cgwb_release cgwb_release_workfn Call Trace: <TASK> blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367) cgwb_release_workfn (mm/backing-dev.c:629) process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385) Freed by task 1016: kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561) css_free_rwork_fn (kernel/cgroup/cgroup.c:5542) process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385) ** Stack based on commit 66672af7a095 ("Add linux-next specific files for 20260410") I am seeing this crash sporadically in Meta fleet across multiple kernel versions. A full reproducer is available at: https://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh (The race window is narrow. To make it easily reproducible, inject a msleep(100) between css_put() and blkcg_unpin_online() in cgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the reproducer triggers the splat reliably in less than a second.) Fix this by moving blkcg_unpin_online() before css_put(), so the cgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online() accesses it.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于mm blk-cgroup中cgwb_release_workfn释放后重用，可能导致访问已释放blkcg。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 59b57717fff8b562825d9d25e0180ad7e8048ca9 ~ 23acef4156c260e8598397a1a2e8b3a23e919893 -
Linux Linux 4.19 -

II. Public POCs for CVE-2026-31586

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-31586

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-31586 (5)

Same Patch Batch · Linux · 2026-04-24 · 138 CVEs total

CVE-2026-31633 9.8 CRITICAL rxrpc: Fix integer overflow in rxgk_verify_response()
CVE-2026-31589 9.8 CRITICAL mm: call ->free_folio() directly in folio_unmap_invalidate()
CVE-2026-31637 9.8 CRITICAL rxrpc: reject undecryptable rxkad response tickets
CVE-2026-31669 9.8 CRITICAL mptcp: fix slab-use-after-free in __inet_lookup_established
CVE-2026-31668 9.8 CRITICAL seg6: separate dst_cache for input and output paths in seg6 lwtunnel
CVE-2026-31536 9.8 CRITICAL smb: server: let send_done handle a completion without IB_SEND_SIGNALED
CVE-2026-31649 9.8 CRITICAL net: stmmac: fix integer underflow in chain mode
CVE-2026-31607 9.8 CRITICAL usbip: validate number_of_packets in usbip_pack_ret_submit()
CVE-2026-31608 9.8 CRITICAL smb: server: avoid double-free in smb_direct_free_sendmsg after smb_direct_flush_send_list
CVE-2026-31609 9.8 CRITICAL smb: client: avoid double-free in smbd_free_send_io() after smbd_send_batch_flush()
CVE-2026-31657 9.8 CRITICAL batman-adv: hold claim backbone gateways by reference
CVE-2026-31659 9.8 CRITICAL batman-adv: reject oversized global TT response buffers
CVE-2026-31636 9.1 CRITICAL rxrpc: fix RESPONSE authenticator parser OOB read
CVE-2026-31629 8.8 HIGH nfc: llcp: add missing return after LLCP_CLOSED checks
CVE-2026-31588 8.8 HIGH KVM: x86: Use scratch field in MMIO fragment to hold small write values
CVE-2026-31570 8.8 HIGH can: gw: fix OOB heap access in cgw_csum_crc8_rel()
CVE-2026-31558 8.8 HIGH LoongArch: KVM: Make kvm_get_vcpu_by_cpuid() more robust
CVE-2026-31553 8.8 HIGH KVM: arm64: Fix the descriptor address in __kvm_at_swap_desc()
CVE-2026-31622 8.8 HIGH NFC: digital: Bounds check NFC-A cascade depth in SDD response handler
CVE-2026-31611 8.6 HIGH ksmbd: require 3 sub-authorities before reading sub_auth[2]

Showing top 20 of 138 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-31586

No comments yet

Leave a comment