{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-31580",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-31580",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-04-24T14:42:10.874Z",
    "updatedAt": "2026-10-15T01:17:05.087Z",
    "importedAt": "2026-10-24T01:58:02.025Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "bcache: fix cached_dev.sb_bio use-after-free and crash",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nbcache: fix cached_dev.sb_bio use-after-free and crash\n\nIn our production environment, we have received multiple crash reports\nregarding libceph, which have caught our attention:\n\n```\n[6888366.280350] Call Trace:\n[6888366.280452]  blk_update_request+0x14e/0x370\n[6888366.280561]  blk_mq_end_request+0x1a/0x130\n[6888366.280671]  rbd_img_handle_request+0x1a0/0x1b0 [rbd]\n[6888366.280792]  rbd_obj_handle_request+0x32/0x40 [rbd]\n[6888366.280903]  __complete_request+0x22/0x70 [libceph]\n[6888366.281032]  osd_dispatch+0x15e/0xb40 [libceph]\n[6888366.281164]  ? inet_recvmsg+0x5b/0xd0\n[6888366.281272]  ? ceph_tcp_recvmsg+0x6f/0xa0 [libceph]\n[6888366.281405]  ceph_con_process_message+0x79/0x140 [libceph]\n[6888366.281534]  ceph_con_v1_try_read+0x5d7/0xf30 [libceph]\n[6888366.281661]  ceph_con_workfn+0x329/0x680 [libceph]\n```\n\nAfter analyzing the coredump file, we found that the address of\ndc->sb_bio has been freed. We know that cached_dev is only freed when it\nis stopped.\n\nSince sb_bio is a part of struct cached_dev, rather than an alloc every\ntime.  If the device is stopped while writing to the superblock, the\nreleased address will be accessed at endio.\n\nThis patch hopes to wait for sb_write to complete in cached_dev_free.\n\nIt should be noted that we analyzed the cause of the problem, then tell\nall details to the QWEN and adopted the modifications it made.",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "81f44ed8c3f54abb7561ece774ea4cca5070b2f2"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "f50e7c325ab1207fe941555bcff659f6d7050572"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9467d360be70e6ee55b0c1cd2a1f1424f57b5b85"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "47fa09fe7f3e09df28a51cb2cbd8f5d2f7f6edc1"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "add4982510f3b7c318a2dd7438bdc9c63171e753"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2d6965581e164fa2ba3f7652ddae5535f6336576"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "4f71c8ba2dc009042493021d94a9718fbe2ebf27"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "383f7fec0de8cee1cf7ae1f9d9f14044a61f10f9"
            },
            {
              "version": "cafe563591446cf80bfbc2fe3bc72a2e36cf1060",
              "status": "affected",
              "versionType": "git",
              "lessThan": "fec114a98b8735ee89c75216c45a78e28be0f128"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "3.10",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "3.10"
            },
            {
              "version": "5.10.258",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "version": "5.15.209",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "version": "6.1.175",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "version": "6.6.136",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "version": "6.12.83",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.24",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "6.19.14",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.19.*"
            },
            {
              "version": "7.0.1",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "version": "7.1",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}