01 Record

CVE-2026-31446

ext4: fix use-after-free in update_super_work when racing with umount

HighPUBLISHEDCNA: Linux

CNA base score7.8 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

View raw JSON

02 Description

ext4: fix use-after-free in update_super_work when racing with umount

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.13% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 3.2% of scored records. A rank, not a probability.

NVD base score

7.8 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD analysis status

Modified. NVD last modified this record on 2026-10-19.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-04-22 13:53Z6 MO AGO

Last updated

2026-10-19 18:35Z10 DAYS AGO

Reserved

2026-03-09

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 7.8)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-416Use After FreeVariant

Data version

5.2

Document digest

965d54a9bae50546a22e66464568e59f792ca9483ff68d3d044eedadc2925ed6

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux52c3a04f9ec2a16a4204d6274db338cb8d5b2d74 to < c8fe17a1b308c3d8c703ebfb049b325f844342c3, b98535d091795a79336f520b0708457aacf55c67 to < c4d829737329f2290dd41e290b7d75effdb2a7ff, b98535d091795a79336f520b0708457aacf55c67 to < 9449f99ba04f5dd1c8423ad8a90b3651d7240d1d, b98535d091795a79336f520b0708457aacf55c67 to < 034053378dd81837fd6c7a43b37ee2e58d4f0b4e, b98535d091795a79336f520b0708457aacf55c67 to < c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe, b98535d091795a79336f520b0708457aacf55c67 to < 08b10e6f37fc533a759e9833af0692242e8b3f93, b98535d091795a79336f520b0708457aacf55c67 to < d15e4b0a418537aafa56b2cb80d44add83e83697, 585ef03c9e79672781f954daae730dfe24bf3a46, afe490e48d47df1b3f64012835c1bc2f075a8c8b, 5.15.38 to < 5.15.203, 5.10.114 to < 5.11, 5.17.6 to < 5.18, 5.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/c8fe17a1b308c3d8c703ebfb049b325f844342c3
git.kernel.orghttps://git.kernel.org/stable/c/c4d829737329f2290dd41e290b7d75effdb2a7ff
git.kernel.orghttps://git.kernel.org/stable/c/9449f99ba04f5dd1c8423ad8a90b3651d7240d1d
git.kernel.orghttps://git.kernel.org/stable/c/034053378dd81837fd6c7a43b37ee2e58d4f0b4e
git.kernel.orghttps://git.kernel.org/stable/c/c97e282f7bfd0c3554c63d289964a5ca6a1d2ffe
git.kernel.orghttps://git.kernel.org/stable/c/08b10e6f37fc533a759e9833af0692242e8b3f93
git.kernel.orghttps://git.kernel.org/stable/c/d15e4b0a418537aafa56b2cb80d44add83e83697
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-082556.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-457936.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.170-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.85-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 6.19.11-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.