{ "schemaVersion": 1, "attribution": [ { "source": "CISA Known Exploited Vulnerabilities", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "licence": "US government work" }, { "source": "GitHub Advisory Database", "url": "https://github.com/advisories", "licence": "CC BY 4.0" }, { "source": "Have I Been Pwned", "url": "https://haveibeenpwned.com/", "licence": "CC BY 4.0" }, { "source": "CVE Program (CVE records)", "url": "https://www.cve.org/Legal/TermsOfUse", "licence": "CVE Terms of Use", "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.", "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy." }, { "source": "FIRST EPSS", "url": "https://www.first.org/epss/", "licence": "free to use; FIRST requests attribution" } ], "record": { "id": "CVE-2026-31586", "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-31586", "idYear": 2026, "status": "PUBLISHED", "publishedAt": "2026-04-24T14:42:14.937Z", "updatedAt": "2026-10-19T18:55:59.448Z", "importedAt": "2026-10-24T01:58:02.025Z", "snapshot": { "id": "cve_2026-10-24_midnight_baseline", "at": "2026-10-24T00:00:00.000Z", "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z" }, "facts": { "title": "mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()", "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\nmm: blk-cgroup: fix use-after-free in cgwb_release_workfn()\n\ncgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses\nwb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last\nreference, the blkcg can be freed asynchronously (css_free_rwork_fn ->\nblkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the\npointer to access blkcg->online_pin, resulting in a use-after-free:\n\n BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531\n Workqueue: cgwb_release cgwb_release_workfn\n Call Trace:\n \n blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)\n cgwb_release_workfn (mm/backing-dev.c:629)\n process_scheduled_works (kernel/workqueue.c:3278 kernel/workqueue.c:3385)\n\n Freed by task 1016:\n kfree (./include/linux/kasan.h:235 mm/slub.c:2689 mm/slub.c:6246 mm/slub.c:6561)\n css_free_rwork_fn (kernel/cgroup/cgroup.c:5542)\n process_scheduled_works (kernel/workqueue.c:3302 kernel/workqueue.c:3385)\n\n** Stack based on commit 66672af7a095 (\"Add linux-next specific files\nfor 20260410\")\n\nI am seeing this crash sporadically in Meta fleet across multiple kernel\nversions. A full reproducer is available at:\nhttps://github.com/leitao/debug/blob/main/reproducers/repro_blkcg_uaf.sh\n\n(The race window is narrow. To make it easily reproducible, inject a\nmsleep(100) between css_put() and blkcg_unpin_online() in\ncgwb_release_workfn(). With that delay and a KASAN-enabled kernel, the\nreproducer triggers the splat reliably in less than a second.)\n\nFix this by moving blkcg_unpin_online() before css_put(), so the\ncgwb's CSS reference keeps the blkcg alive while blkcg_unpin_online()\naccesses it.", "affected": [ { "vendor": "Linux", "product": "Linux", "defaultStatus": "unaffected", "versions": [ { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "23acef4156c260e8598397a1a2e8b3a23e919893" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "1bd36e93b542d9dd020190c6607c6a3663405195" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "740ba1ebb223f137ff088ab74d533a13f9167bd8" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "115a5266749dcde7fe4127e8623d19c752088f69" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "dfc8292a1d6782c76b626315605e0585a5a18447" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "ea3af09eb87d8f8708c66747fcf1a2762902e839" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "50879a3c1faf06e661090015d59e2127255cff27" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "67cb119d32f35e32acd0393bbeb318b2bb1fdafe" }, { "version": "59b57717fff8b562825d9d25e0180ad7e8048ca9", "status": "affected", "versionType": "git", "lessThan": "8f5857be99f1ed1fa80991c72449541f634626ee" } ] }, { "vendor": "Linux", "product": "Linux", "defaultStatus": "affected", "versions": [ { "version": "4.19", "status": "affected" }, { "version": "0", "status": "unaffected", "versionType": "semver", "lessThan": "4.19" }, { "version": "5.10.258", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.10.*" }, { "version": "5.15.209", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "5.15.*" }, { "version": "6.1.175", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.1.*" }, { "version": "6.6.136", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.6.*" }, { "version": "6.12.83", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.12.*" }, { "version": "6.18.24", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.18.*" }, { "version": "6.19.14", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "6.19.*" }, { "version": "7.0.1", "status": "unaffected", "versionType": "semver", "lessThanOrEqual": "7.0.*" }, { "version": "7.1", "status": "unaffected", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*" } ] } ] } } }