{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-23224", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.987Z", "datePublished": "2026-02-18T14:53:27.462Z", "dateUpdated": "2026-08-05T12:20:42.343Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:20:42.343Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: fix UAF issue for file-backed mounts w/ directio option\n\n[ 9.269940][ T3222] Call trace:\n[ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108\n[ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198\n[ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180\n[ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24\n[ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac\n[ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220\n[ 9.270083][ T3222] filemap_read_folio+0x60/0x120\n[ 9.270102][ T3222] filemap_fault+0xcac/0x1060\n[ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554\n[ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c\n[ 9.270142][ T3222] do_page_fault+0x178/0x88c\n[ 9.270167][ T3222] do_translation_fault+0x38/0x54\n[ 9.270183][ T3222] do_mem_abort+0x54/0xac\n[ 9.270208][ T3222] el0_da+0x44/0x7c\n[ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4\n[ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0\n\nEROFS may encounter above panic when enabling file-backed mount w/\ndirectio mount option, the root cause is it may suffer UAF in below\nrace condition:\n\n- z_erofs_read_folio wq s_dio_done_wq\n - z_erofs_runqueue\n - erofs_fileio_submit_bio\n - erofs_fileio_rq_submit\n - vfs_iocb_iter_read\n - ext4_file_read_iter\n - ext4_dio_read_iter\n - iomap_dio_rw\n : bio was submitted and return -EIOCBQUEUED\n - dio_aio_complete_work\n - dio_complete\n - dio->iocb->ki_complete (erofs_fileio_ki_complete())\n - kfree(rq)\n : it frees iocb, iocb.ki_filp can be UAF in file_accessed().\n - file_accessed\n : access NULL file point\n\nIntroduce a reference count in struct erofs_fileio_rq, and initialize it\nas two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will\ndecrease reference count, the last one decreasing the reference count\nto zero will free rq." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered by reading a file on a locally mounted EROFS filesystem. No network vector is involved; the attacker needs local access to read files on the mount.\nAC:L - The race condition is deterministic — whenever the backing file's DIO returns -EIOCBQUEUED (the normal async case), the completion handler frees the rq before the submission path finishes using it. The attacker simply reads a file; no special timing or conditions are needed beyond the directio mount configuration.\nPR:L - While mounting EROFS with directio requires root, once mounted any unprivileged user who can read files on the filesystem triggers the UAF. In deployment scenarios like Android or containers where EROFS is commonly used, unprivileged processes regularly access EROFS-mounted files.\nUI:N - No user interaction is required at attack time. The attacker simply reads a file on the EROFS mount; no victim needs to perform any action.\nS:U - The vulnerability and impact remain within the kernel's security authority. There is no crossing of security boundaries such as VM escape or IOMMU bypass.\nC:H - This is a use-after-free on a heap-allocated structure. An attacker can potentially reclaim the freed memory via heap spraying to read arbitrary kernel memory through the stale pointer dereference, providing information disclosure.\nI:H - The UAF on the heap-allocated erofs_fileio_rq structure enables heap spraying to place attacker-controlled data in the freed slot, potentially achieving arbitrary write primitives and code execution through control flow hijacking.\nA:H - The UAF causes an immediate kernel crash/oops when accessing the freed rq->iocb.ki_filp pointer, as shown in the commit's call trace. Any file read on the affected mount reliably triggers a kernel panic." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/fileio.c" ], "versions": [ { "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "ae385826840a3c8e09bf38cac90adcd690716f57", "status": "affected", "versionType": "git" }, { "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "d741534302f71c511eb0bb670b92eaa7df4a0aec", "status": "affected", "versionType": "git" }, { "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa", "status": "affected", "versionType": "git" }, { "version": "fb176750266a3d7f42ebdcf28e8ba40350b27847", "lessThan": "1caf50ce4af096d0280d59a31abdd85703cd995c", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "fs/erofs/fileio.c" ], "versions": [ { "version": "6.12", "status": "affected" }, { "version": "0", "lessThan": "6.12", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.72", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.11", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.1", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.12.72" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.18.11" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "6.19.1" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/ae385826840a3c8e09bf38cac90adcd690716f57" }, { "url": "https://git.kernel.org/stable/c/d741534302f71c511eb0bb670b92eaa7df4a0aec" }, { "url": "https://git.kernel.org/stable/c/b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa" }, { "url": "https://git.kernel.org/stable/c/1caf50ce4af096d0280d59a31abdd85703cd995c" } ], "title": "erofs: fix UAF issue for file-backed mounts w/ directio option", "x_generator": { "engine": "bippy-1.2.0" } } } }