Vulnerability-Lookup

GHSA-Q892-7MJJ-MJX9

Vulnerability from github – Published: 2026-04-22 15:31 – Updated: 2026-04-22 15:31

Details

In the Linux kernel, the following vulnerability has been resolved:

xfs: stop reclaim before pushing AIL during unmount

The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.

Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-31455"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-04-22T14:16:40Z",
    "severity": null
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable.",
  "id": "GHSA-q892-7mjj-mjx9",
  "modified": "2026-04-22T15:31:41Z",
  "published": "2026-04-22T15:31:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-31455"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

CVE-2026-31455 (GCVE-0-2026-31455)

Vulnerability from cvelistv5 – Published: 2026-04-22 13:53 – Updated: 2026-04-22 13:53

Title

xfs: stop reclaim before pushing AIL during unmount

Summary

In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.

Severity ?

No CVSS data available.

Assigner

Linux

References

URL

Tags

	https://git.kernel.org/stable/c/e6cc490048f78b009…
	https://git.kernel.org/stable/c/239d734c006440728…
	https://git.kernel.org/stable/c/bda27fc0b4eb3a425…
	https://git.kernel.org/stable/c/d38135af04a3ad8a5…
	https://git.kernel.org/stable/c/a89434a6188d8430e…
	https://git.kernel.org/stable/c/8147e304d7d32fd5c…
	https://git.kernel.org/stable/c/558e3275d8a3b101b…
	https://git.kernel.org/stable/c/4f24a767e3d64a5f5…

Impacted products

Vendor

Product

Version

Linux

Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < e6cc490048f78b009259a5f032acead9f789c34c (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 239d734c00644072862fa833805c4471573b1445 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < bda27fc0b4eb3a425d9a18475c4cb94fbe862c60 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < d38135af04a3ad8a585c899d176efc8e97853115 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < a89434a6188d8430ea31120da96e3e4cefb58686 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 8147e304d7d32fd5c3e943babc296ce2873dc279 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 558e3275d8a3b101be18a7fe7d1634053e9d9b07 (git)
Affected: 90c60e16401248a4900f3f9387f563d0178dcf34 , < 4f24a767e3d64a5f58c595b5c29b6063a201f1e3 (git)

Linux

Affected: 5.9
Unaffected: 0 , < 5.9 (semver)
Unaffected: 5.10.253 , ≤ 5.10.* (semver)
Unaffected: 5.15.203 , ≤ 5.15.* (semver)
Unaffected: 6.1.168 , ≤ 6.1.* (semver)
Unaffected: 6.6.131 , ≤ 6.6.* (semver)
Unaffected: 6.12.80 , ≤ 6.12.* (semver)
Unaffected: 6.18.21 , ≤ 6.18.* (semver)
Unaffected: 6.19.11 , ≤ 6.19.* (semver)
Unaffected: 7.0 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_mount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e6cc490048f78b009259a5f032acead9f789c34c",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "239d734c00644072862fa833805c4471573b1445",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "bda27fc0b4eb3a425d9a18475c4cb94fbe862c60",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "d38135af04a3ad8a585c899d176efc8e97853115",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "a89434a6188d8430ea31120da96e3e4cefb58686",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "8147e304d7d32fd5c3e943babc296ce2873dc279",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "558e3275d8a3b101be18a7fe7d1634053e9d9b07",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            },
            {
              "lessThan": "4f24a767e3d64a5f58c595b5c29b6063a201f1e3",
              "status": "affected",
              "version": "90c60e16401248a4900f3f9387f563d0178dcf34",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/xfs/xfs_mount.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.9"
            },
            {
              "lessThan": "5.9",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.253",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.203",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.168",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.131",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.80",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.21",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.19.*",
              "status": "unaffected",
              "version": "6.19.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.253",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.203",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.168",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.131",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.80",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.21",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.19.11",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0",
                  "versionStartIncluding": "5.9",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfs: stop reclaim before pushing AIL during unmount\n\nThe unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while\nbackground reclaim and inodegc are still running. This is broken\nindependently of any use-after-free issues - background reclaim and\ninodegc should not be running while the AIL is being pushed during\nunmount, as inodegc can dirty and insert inodes into the AIL during the\nflush, and background reclaim can race to abort and free dirty inodes.\n\nReorder xfs_unmount_flush_inodes() to stop inodegc and cancel background\nreclaim before pushing the AIL. Stop inodegc before cancelling\nm_reclaim_work because the inodegc worker can re-queue m_reclaim_work\nvia xfs_inodegc_set_reclaimable."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-04-22T13:53:48.914Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e6cc490048f78b009259a5f032acead9f789c34c"
        },
        {
          "url": "https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445"
        },
        {
          "url": "https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60"
        },
        {
          "url": "https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115"
        },
        {
          "url": "https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686"
        },
        {
          "url": "https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279"
        },
        {
          "url": "https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07"
        },
        {
          "url": "https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3"
        }
      ],
      "title": "xfs: stop reclaim before pushing AIL during unmount",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-31455",
    "datePublished": "2026-04-22T13:53:48.914Z",
    "dateReserved": "2026-03-09T15:48:24.092Z",
    "dateUpdated": "2026-04-22T13:53:48.914Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-Q892-7MJJ-MJX9

CVE-2026-31455 (GCVE-0-2026-31455)

Tags

Sightings

Nomenclature