CVE-2026-31465

{"id": "CVE-2026-31465", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "lessThan": "83800f8ef358ea2fc9b1ae4986b83f2bc24be927", "versionType": "git"}, {"status": "affected", "version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "lessThan": "5c24a13d8a0466ca0446e58309e51f2606520164", "versionType": "git"}, {"status": "affected", "version": "0c58a97f919c24fe4245015f4375a39ff05665b6", "lessThan": "76f9377cd2ab7a9220c25d33940d9ca20d368172", "versionType": "git"}], "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "fs/fuse/inode.c", "include/linux/fs/super_types.h", "include/linux/pagemap.h"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.16"}, {"status": "unaffected", "version": "0", "lessThan": "6.16", "versionType": "semver"}, {"status": "unaffected", "version": "6.18.21", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.11", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["fs/fs-writeback.c", "fs/fuse/file.c", "fs/fuse/inode.c", "include/linux/fs/super_types.h", "include/linux/pagemap.h"], "defaultStatus": "affected"}]}], "published": "2026-04-22T14:16:42.633", "references": [{"url": "https://git.kernel.org/stable/c/5c24a13d8a0466ca0446e58309e51f2606520164", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/76f9377cd2ab7a9220c25d33940d9ca20d368172", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/83800f8ef358ea2fc9b1ae4986b83f2bc24be927", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nwriteback: don't block sync for filesystems with no data integrity guarantees\n\nAdd a SB_I_NO_DATA_INTEGRITY superblock flag for filesystems that cannot\nguarantee data persistence on sync (eg fuse). For superblocks with this\nflag set, sync kicks off writeback of dirty inodes but does not wait\nfor the flusher threads to complete the writeback.\n\nThis replaces the per-inode AS_NO_DATA_INTEGRITY mapping flag added in\ncommit f9a49aa302a0 (\"fs/writeback: skip AS_NO_DATA_INTEGRITY mappings\nin wait_sb_inodes()\"). The flag belongs at the superblock level because\ndata integrity is a filesystem-wide property, not a per-inode one.\nHaving this flag at the superblock level also allows us to skip having\nto iterate every dirty inode in wait_sb_inodes() only to skip each inode\nindividually.\n\nPrior to this commit, mappings with no data integrity guarantees skipped\nwaiting on writeback completion but still waited on the flusher threads\nto finish initiating the writeback. Waiting on the flusher threads is\nunnecessary. This commit kicks off writeback but does not wait on the\nflusher threads. This change properly addresses a recent report [1] for\na suspend-to-RAM hang seen on fuse-overlayfs that was caused by waiting\non the flusher threads to finish:\n\nWorkqueue: pm_fs_sync pm_fs_sync_work_fn\nCall Trace:\n <TASK>\n __schedule+0x457/0x1720\n schedule+0x27/0xd0\n wb_wait_for_completion+0x97/0xe0\n sync_inodes_sb+0xf8/0x2e0\n __iterate_supers+0xdc/0x160\n ksys_sync+0x43/0xb0\n pm_fs_sync_work_fn+0x17/0xa0\n process_one_work+0x193/0x350\n worker_thread+0x1a1/0x310\n kthread+0xfc/0x240\n ret_from_fork+0x243/0x280\n ret_from_fork_asm+0x1a/0x30\n </TASK>\n\nOn fuse this is problematic because there are paths that may cause the\nflusher thread to block (eg if systemd freezes the user session cgroups\nfirst, which freezes the fuse daemon, before invoking the kernel\nsuspend. The kernel suspend triggers ->write_node() which on fuse issues\na synchronous setattr request, which cannot be processed since the\ndaemon is frozen. Or if the daemon is buggy and cannot properly complete\nwriteback, initiating writeback on a dirty folio already under writeback\nleads to writeback_get_folio() -> folio_prepare_writeback() ->\nunconditional wait on writeback to finish, which will cause a hang).\nThis commit restores fuse to its prior behavior before tmp folios were\nremoved, where sync was essentially a no-op.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nwriteback: no bloquear la sincronizaci\u00f3n para sistemas de archivos sin garant\u00edas de integridad de datos\n\nA\u00f1adir una bandera de superbloque SB_I_NO_DATA_INTEGRITY para sistemas de archivos que no pueden garantizar la persistencia de datos en la sincronizaci\u00f3n (por ejemplo, fuse). Para superbloques con esta bandera establecida, la sincronizaci\u00f3n inicia el writeback de inodos sucios pero no espera a que los hilos de vaciado completen el writeback.\n\nEsto reemplaza la bandera de mapeo AS_NO_DATA_INTEGRITY por inodo a\u00f1adida en el commit f9a49aa302a0 (\u2019fs/writeback: omitir mapeos AS_NO_DATA_INTEGRITY en wait_sb_inodes()\u2019). La bandera pertenece al nivel del superbloque porque la integridad de los datos es una propiedad de todo el sistema de archivos, no una por inodo. Tener esta bandera a nivel de superbloque tambi\u00e9n nos permite evitar tener que iterar cada inodo sucio en wait_sb_inodes() solo para omitir cada inodo individualmente.\n\nAntes de este commit, los mapeos sin garant\u00edas de integridad de datos omit\u00edan esperar la finalizaci\u00f3n del writeback pero a\u00fan esperaban a que los hilos de vaciado terminaran de iniciar el writeback. Esperar a los hilos de vaciado es innecesario. Este commit inicia el writeback pero no espera a los hilos de vaciado. Este cambio aborda correctamente un informe reciente [1] por un cuelgue de suspensi\u00f3n a RAM visto en fuse-overlayfs que fue causado por esperar a que los hilos de vaciado terminaran:\n\nWorkqueue: pm_fs_sync pm_fs_sync_work_fn\nRastro de Llamada:\n [TAREA]\n __schedule+0x457/0x 1720\n schedule+0x27/0xd0\n wb_wait_for_completion+0x97/0xe0\n sync_inodes_sb+0xf8/0x2e0\n __iterate_supers+0xdc/0x160\n ksys_sync+0x43/0xb0\n pm_fs_sync_work_fn+0x17/0xa0\n process_one_work+0x193/0x350\n worker_thread+0x1a1/0x310\n kthread+0xfc/0x240\n ret_from_fork+0x243/0x280\n ret_from_fork_asm+0x1a/0x30\n [/TAREA]\n\nEn fuse esto es problem\u00e1tico porque hay rutas que pueden causar que el hilo de vaciado se bloquee (por ejemplo, si systemd congela primero los cgroups de la sesi\u00f3n de usuario, lo que congela el demonio fuse, antes de invocar la suspensi\u00f3n del kernel. La suspensi\u00f3n del kernel activa -> write_node() que en fuse emite una solicitud setattr s\u00edncrona, que no puede procesarse ya que el demonio est\u00e1 congelado. O si el demonio tiene errores y no puede completar correctamente el writeback, iniciar el writeback en un folio sucio que ya est\u00e1 en writeback lleva a writeback_get_folio() -> folio_prepare_writeback() -> espera incondicional a que el writeback termine, lo que causar\u00e1 un cuelgue). Este commit restaura fuse a su comportamiento anterior antes de que se eliminaran los folios temporales, donde la sincronizaci\u00f3n era esencialmente una operaci\u00f3n nula.\n\n[1] https://lore.kernel.org/linux-fsdevel/CAJnrk1a-asuvfrbKXbEwwDSctvemF+6zfhdnuzO65Pt8HsFSRw@mail.gmail.com/T/#m632c4648e9cafc4239299887109ebd880ac6c5c1"}], "lastModified": "2026-11-11T23:10:00.263", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A6CA36DA-3783-4321-81A6-485364836084", "versionEndExcluding": "6.18.21", "versionStartIncluding": "6.16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4CA2E747-A9EC-4518-9AA2-B4247FC748B7", "versionEndExcluding": "6.19.11", "versionStartIncluding": "6.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}