CVE-2026-31448 [Critical] | Security Vulnerability in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: ext4: avoid infinite loops caused by residual data On the mkdir/mknod path, when mapping logical blocks to physical blocks, if inserting a new extent into the extent tree fails (in this example, because the file system disabled the huge file feature when marking the inode as dirty), ext4_ext_map_blocks() only calls ext4_free_blocks() to reclaim the physical block without deleting the corresponding data in the extent tree. This causes subsequent mkdir operations to reference the previously reclaimed physical block number again, even though this physical block is already being used by the xattr block. Therefore, a situation arises where both the directory and xattr are using the same buffer head block in memory simultaneously. The above causes ext4_xattr_block_set() to enter an infinite loop about "inserted" and cannot release the inode lock, ultimately leading to the 143s blocking problem mentioned in [1]. If the metadata is corrupted, then trying to remove some extent space can do even more harm. Also in case EXT4_GET_BLOCKS_DELALLOC_RESERVE was passed, remove space wrongly update quota information. Jan Kara suggests distinguishing between two cases: 1) The error is ENOSPC or EDQUOT - in this case the filesystem is fully consistent and we must maintain its consistency including all the accounting. However these errors can happen only early before we've inserted the extent into the extent tree. So current code works correctly for this case. 2) Some other error - this means metadata is corrupted. We should strive to do as few modifications as possible to limit damage. So I'd just skip freeing of allocated blocks. [1] INFO: task syz.0.17:5995 blocked for more than 143 seconds. Call Trace: inode_lock_nested include/linux/fs.h:1073 [inline] __start_dirop fs/namei.c:2923 [inline] start_dirop fs/namei.c:2934 [inline]

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-06-15	0.07%	0.43%	+0.36%
2	2026-04-28	0.02%	0.07%	+0.05%
3	2026-04-23	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-06-15

0.07%

0.43%

+0.36%

2026-04-28

0.02%

0.07%

+0.05%

2026-04-23

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
9.4	3.1	CRITICAL	`CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H` Click to expand Attack vector (AV:N) Could be attacked over the internet or any normal routed network—not just someone sitting at the machine. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:N) No account or special rights needed—anonymous or random user is enough. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:L) Some sensitive info could get out, but not a total data dump. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	3.9	5.5	416baaa9-dc9f-4396-8d5f-8c081fb06d67

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

9.4

3.1

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H Click to expand

Attack vector (AV:N): Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N): No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:L): Some sensitive info could get out, but not a total data dump.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

3.9

5.5

416baaa9-dc9f-4396-8d5f-8c081fb06d67

OS Trackers for CVE-2026-31448

vendor	priority	summary	link
`debian`	not yet assigned	CVE-2026-31448 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5, open 1.	https://security-tracker.debian.org/tracker/CVE-2026-31448
`redhat`	medium	—	https://access.redhat.com/security/cve/CVE-2026-31448
`suse`	medium	CVE-2026-31448 severity moderate: SUSE including 24 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 206 product×package rows across 37 product lines (SUSE Linux Enterprise High Availability Extension 15 SP7, SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, … (37 product lines)): Known Not Affected 206.	https://www.suse.com/security/cve/CVE-2026-31448/
`ubuntu`	medium	CVE-2026-31448 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 173, needed 130, released 83, not-affected 11, needs-triage 4.	https://ubuntu.com/security/CVE-2026-31448

Affected software / configurations for CVE-2026-31448

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 2.6.22.1, < 6.1.168	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.2, < 6.6.131	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.7, < 6.12.80	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.13, < 6.18.21	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.19, < 6.19.11	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	2.6.22	cpe:2.3:o:linux:linux_kernel:2.6.22:-::::::
linux	linux_kernel	2.6.22	cpe:2.3:o:linux:linux_kernel:2.6.22:rc4::::::
linux	linux_kernel	2.6.22	cpe:2.3:o:linux:linux_kernel:2.6.22:rc5::::::
linux	linux_kernel	2.6.22	cpe:2.3:o:linux:linux_kernel:2.6.22:rc6::::::
linux	linux_kernel	2.6.22	cpe:2.3:o:linux:linux_kernel:2.6.22:rc7::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc1::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc2::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc3::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc4::::::
linux	linux_kernel	7.0	cpe:2.3:o:linux:linux_kernel:7.0:rc5::::::

References for CVE-2026-31448

URL	Tags
https://git.kernel.org/stable/c/3a7667595bcad84da53fc156a418e110267c3412	Patch
https://git.kernel.org/stable/c/416c86f30f91b4fb2642ef6b102596ca898f41a5	Patch
https://git.kernel.org/stable/c/5422fe71d26d42af6c454ca9527faaad4e677d6c	Patch
https://git.kernel.org/stable/c/64f425b06b3bea9abc8977fd3982779b3ad070c9	Patch
https://git.kernel.org/stable/c/c66545e83a802c3851d9be27a41c0479dd29ff0c	Patch
https://git.kernel.org/stable/c/ecc50bfca9b5c2ee6aeef998181689b80477367b	Patch

URL

CVE-2026-31448 | ext4: avoid infinite loops caused by residual data

Exploit prediction scoring system (EPSS) score for CVE-2026-31448

Common vulnerability scoring system (CVSS) metrics for CVE-2026-31448

Weakness enumeration for CVE-2026-31448

GitHub Security Advisory for CVE-2026-31448

OS Trackers for CVE-2026-31448

Affected software / configurations for CVE-2026-31448

References for CVE-2026-31448