CVE-2026-31703 [High] | Use-After-Free in Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: writeback: Fix use after free in inode_switch_wbs_work_fn() inode_switch_wbs_work_fn() has a loop like: wb_get(new_wb); while (1) { list = llist_del_all(&new_wb->switch_wbs_ctxs); /* Nothing to do? */ if (!list) break; ... process the items ... } Now adding of items to the list looks like: wb_queue_isw() if (llist_add(&isw->list, &wb->switch_wbs_ctxs)) queue_work(isw_wq, &wb->switch_work); Because inode_switch_wbs_work_fn() loops when processing isw items, it can happen that wb->switch_work is pending while wb->switch_wbs_ctxs is empty. This is a problem because in that case wb can get freed (no isw items -> no wb reference) while the work is still pending causing use-after-free issues. We cannot just fix this by cancelling work when freeing wb because that could still trigger problematic 0 -> 1 transitions on wb refcount due to wb_get() in inode_switch_wbs_work_fn(). It could be all handled with more careful code but that seems unnecessarily complex so let's avoid that until it is proven that the looping actually brings practical benefit. Just remove the loop from inode_switch_wbs_work_fn() instead. That way when wb_queue_isw() queues work, we are guaranteed we have added the first item to wb->switch_wbs_ctxs and nobody is going to remove it (and drop the wb reference it holds) until the queued work runs.

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2026-05-02	—	0.02%	—

Date

Old EPSS score

New EPSS score

Delta (New - Old)

2026-05-02

—

0.02%

—

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.8	3.1	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H` Click to expand Attack vector (AV:L) They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by. Attack complexity (AC:L) Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup. Privileges required (PR:L) A normal user session is enough; they don’t have to be admin. User interaction (UI:N) Nobody has to click “OK” or open a trap file; it can work without a victim helping. Scope (S:U) Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems. Confidentiality (C:H) Serious risk that confidential data gets exposed in a big way. Integrity (I:H) They could widely tamper with or forge data—trust in the data is badly hurt. Availability (A:H) Could take the service down hard or make it unusable for people who depend on it.	1.8	5.9	416baaa9-dc9f-4396-8d5f-8c081fb06d67

Base score

Version

Severity

Vector

Exploitability

Impact

Score source

7.8

3.1

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand

Attack vector (AV:L): They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L): Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L): A normal user session is enough; they don’t have to be admin.
User interaction (UI:N): Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U): Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H): Serious risk that confidential data gets exposed in a big way.
Integrity (I:H): They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H): Could take the service down hard or make it unusable for people who depend on it.

1.8

5.9

416baaa9-dc9f-4396-8d5f-8c081fb06d67

OS Trackers for CVE-2026-31703

vendor	priority	summary	link
`debian`	unimportant	CVE-2026-31703 unimportant priority: Debian including 1 source packages (linux), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5.	https://security-tracker.debian.org/tracker/CVE-2026-31703
`redhat`	high	—	https://access.redhat.com/security/cve/CVE-2026-31703
`suse`	medium	CVE-2026-31703 severity moderate: SUSE including 19 source package names (cluster-md-kmp-default, dlm-kmp-default, …), 123 product×package rows across 23 product lines (SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS, SUSE Linux Enterprise High Performance Computing 15 SP5-LTSS, … (23 product lines)): Known Not Affected 123.	https://www.suse.com/security/cve/CVE-2026-31703/
`ubuntu`	medium	CVE-2026-31703 medium priority: Ubuntu including 161 source packages (linux, linux-allwinner-5.19, …), 1449 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1048, ignored 169, not-affected 134, released 83, needed 10, needs-triage 4, pending 1.	https://ubuntu.com/security/CVE-2026-31703

Affected software / configurations for CVE-2026-31703

Vendor	Product	Version	Raw CPE
linux	linux_kernel	>= 6.18, < 6.18.25	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	>= 6.19, < 7.0.2	cpe:2.3:o:linux:linux_kernel::::::::
linux	linux_kernel	7.1	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
linux	linux_kernel	7.1	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::

References for CVE-2026-31703

URL	Tags
https://git.kernel.org/stable/c/028103656b84273c73e9e271cf95c9f3421f4b8a	Patch
https://git.kernel.org/stable/c/6689f01d6740cf358932b3e97ee968c6099800d9	Patch
https://git.kernel.org/stable/c/9223e5f30403a9b506d6d0bff4f2e29a2d7d46af	Patch

URL

CVE-2026-31703 | writeback: Fix use after free in inode_switch_wbs_work_fn()

Exploit prediction scoring system (EPSS) score for CVE-2026-31703

Common vulnerability scoring system (CVSS) metrics for CVE-2026-31703

Weakness enumeration for CVE-2026-31703

GitHub Security Advisory for CVE-2026-31703

OS Trackers for CVE-2026-31703

Affected software / configurations for CVE-2026-31703

References for CVE-2026-31703