CVE-2026-31453 xfs: avoid dereferencing log items after push callbacks
A use-after-free vulnerability in the Linux kernel XFS filesystem allows local attackers to cause a denial of service via log item dereferencing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-31453?
CVE-2026-31453 is a high-severity use after free vulnerability in Linux kernel, published on 22 Apr 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
xfs: avoid dereferencing log items after push callbacks
After xfsaild_push_item() calls iop_push(), the log item may have been freed if the AIL lock was dropped during the push. Background inode reclaim or the dquot shrinker can free the log item while the AIL lock is not held, and the tracepoints in the switch statement dereference the log item after iop_push() returns.
Fix this by capturing the log item type, flags, and LSN before calling xfsaild_push_item(), and introducing a new xfs_ail_push_class trace event class that takes these pre-captured values and the ailp pointer instead of the log item pointer.
Which versions are affected by CVE-2026-31453?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-31453?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-31453 being exploited?
There is no known exploitation of CVE-2026-31453 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-83357, BELL-CVE-2026-31453, DEBIAN-CVE-2026-31453, GHSA-h88h-485v-q9qv, ROOT-OS-DEBIAN-11-CVE-2026-31453, ROOT-OS-DEBIAN-12-CVE-2026-31453 and 4 more.