CVE-2026-31467: Linux Kernel EROFS DoS Vulnerability

CVE-2026-31467 Overview

A deadlock vulnerability has been identified in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem. The vulnerability exists in the bio completion path where the process context (e.g., dm-verity) directly calls into decompression rather than triggering another workqueue context for minimal scheduling latencies. This can then call vm_map_ram() with GFP_KERNEL, which under insufficient memory conditions may generate memory swapping I/O that causes submit_bio_wait to deadlock.

Critical Impact
Systems running Linux kernels with EROFS may experience complete system hangs due to deadlock conditions when memory pressure triggers swap I/O during bio completion, particularly affecting systems using dm-verity for integrity verification.

Affected Products

Linux Kernel with EROFS filesystem support
Systems using dm-verity with EROFS
Linux-based storage systems with MMC block devices

Discovery Timeline

2026-04-22 - CVE CVE-2026-31467 published to NVD
2026-04-23 - Last updated in NVD database

Technical Details for CVE-2026-31467

Vulnerability Analysis

This vulnerability represents a classic deadlock scenario in the Linux kernel's memory management and block I/O subsystems. The issue occurs when the EROFS bio completion handler executes in process context and directly invokes decompression routines. When vm_map_ram() is called with GFP_KERNEL flags during memory-constrained conditions, the kernel attempts memory reclamation which can trigger swap writeback operations.

The critical problem arises because the bio_list is already initialized at the start of the I/O submission path. When submit_bio_wait is called from within the swap writepage operation while bio_list is non-NULL, the kernel enters a deadlock state. The nested bio submission cannot complete because it's waiting on resources held by the outer bio operation that's waiting for the inner operation to complete.

Root Cause

The root cause is the use of GFP_KERNEL allocation flags in a context where I/O operations are already in progress. The vm_map_ram() function, when called during EROFS decompression in the bio completion path, uses allocation flags that allow the kernel to perform direct memory reclamation. This reclamation process can invoke swap I/O, which conflicts with the already-active bio list management, creating an unresolvable circular dependency.

The problematic call chain demonstrates how:

f2fs_submit_read_io initializes the bio_list and calls submit_bio
MMC block recovery triggers z_erofs_endio
EROFS endio handler calls vm_map_ram for page table mapping
Under memory pressure, __alloc_pages_direct_reclaim attempts to free memory
Page reclamation leads to __swap_writepage calling submit_bio_wait
Deadlock occurs because bio_list is already non-NULL

Attack Vector

This vulnerability is triggered under specific system conditions rather than through direct exploitation. The conditions required include:

A system with EROFS filesystem mounted, particularly with dm-verity enabled
Sufficient memory pressure to trigger direct reclamation during page allocation
Active I/O operations through the MMC block device subsystem

While not directly exploitable for code execution, an attacker with local access could potentially trigger memory pressure conditions to cause a denial of service through system hang. The vulnerability manifests as a complete system deadlock rather than a crash, making it particularly problematic for production systems where availability is critical.

Detection Methods for CVE-2026-31467

Indicators of Compromise

System hangs during heavy I/O operations with EROFS filesystems mounted
Kernel stack traces showing submit_bio_wait blocked indefinitely
Hung task warnings in kernel logs indicating bio completion deadlock
Memory allocation failures followed by system unresponsiveness

Detection Strategies

Monitor for hung task warnings in /var/log/kern.log related to EROFS or bio operations
Enable kernel deadlock detection via CONFIG_DETECT_HUNG_TASK and monitor for relevant stack traces
Watch for elevated swap activity coinciding with EROFS I/O operations
Deploy system monitoring to detect prolonged I/O wait states on EROFS mounts

Monitoring Recommendations

Configure hung_task_timeout_secs to detect stuck processes in bio wait states
Implement memory pressure monitoring to identify conditions that could trigger the vulnerability
Monitor vmstat and iostat outputs for unusual patterns in swap and block I/O
Set up alerts for kernel oops or hang detection events mentioning EROFS or z_erofs components

How to Mitigate CVE-2026-31467

Immediate Actions Required

Apply the kernel patches that implement memalloc_noio_save() and memalloc_noio_restore() wrappers
Update to a patched kernel version that includes the EROFS memory allocation fix
Consider reducing memory pressure on affected systems until patching is complete
Monitor systems with EROFS mounts for signs of deadlock behavior

Patch Information

The fix wraps the problematic code path with memalloc_noio_{save,restore}() calls, which prevents memory allocations within this context from triggering I/O operations that could lead to deadlock. Multiple kernel commits have been released to address this issue across various stable kernel branches. Patches are available in the kernel Git repository:

Workarounds

Increase system RAM to reduce likelihood of memory pressure triggering reclamation during bio completion
Configure swap priority and usage to minimize swap operations during heavy I/O
Consider temporarily disabling or reducing reliance on EROFS if patching is not immediately possible
Use memory cgroup limits to prevent processes from triggering extreme memory pressure

bash

# Reduce swap aggressiveness to minimize deadlock trigger conditions
echo 10 > /proc/sys/vm/swappiness

# Increase memory available for kernel operations
echo 1 > /proc/sys/vm/overcommit_memory

# Monitor for hung tasks with shorter timeout
echo 120 > /proc/sys/kernel/hung_task_timeout_secs