CVE-2026-31586: Linux Kernel Use-After-Free Vulnerability

CVE-2026-31586 Overview

CVE-2026-31586 is a use-after-free vulnerability in the Linux kernel's block cgroup (blk-cgroup) subsystem. The flaw resides in cgwb_release_workfn() within mm/backing-dev.c, where the function calls css_put(wb->blkcg_css) and subsequently accesses wb->blkcg_css again through blkcg_unpin_online(). If css_put() drops the last reference, the blkcg structure can be freed asynchronously by css_free_rwork_fn before blkcg_unpin_online() dereferences the pointer to access blkcg->online_pin. Meta engineers observed sporadic crashes across multiple kernel versions in production fleet deployments. The vulnerability is tracked under [CWE-416] (Use After Free).

Critical Impact
Local attackers with low privileges can trigger memory corruption in the kernel, potentially leading to privilege escalation, denial of service, or arbitrary kernel memory modification.

Affected Products

Linux Kernel (multiple stable branches, per upstream commits)
Distributions shipping vulnerable mm/backing-dev.c and block/blk-cgroup.c code paths
Systems with cgroup v1/v2 and writeback control enabled

Discovery Timeline

2026-04-24 - CVE-2026-31586 published to NVD
2026-04-28 - Last updated in NVD database

Technical Details for CVE-2026-31586

Vulnerability Analysis

The vulnerability is a classic use-after-free race condition in the cgroup writeback (cgwb) release workflow. When a cgroup writeback structure is released, cgwb_release_workfn() performs cleanup that includes releasing the cgroup subsystem state (CSS) reference via css_put(wb->blkcg_css). The function then calls blkcg_unpin_online(), which dereferences the same wb->blkcg_css pointer to access the online_pin refcount.

If css_put() drops the final reference, the kernel schedules asynchronous freeing through css_free_rwork_fn, which calls blkcg_css_free and ultimately kfree. When blkcg_unpin_online() subsequently runs, it accesses memory that has already been released back to the slab allocator, producing a KASAN slab-use-after-free splat at block/blk-cgroup.c:1367.

Root Cause

The root cause is incorrect ordering of reference-count operations in cgwb_release_workfn(). The function releases the CSS reference before completing all accesses to fields owned by that CSS. The CSS reference is precisely what keeps the blkcg allocation alive, so dropping it first violates the lifetime contract.

The upstream fix reorders the operations so that blkcg_unpin_online() executes before css_put(). This guarantees the cgwb's CSS reference keeps the blkcg structure alive while blkcg_unpin_online() dereferences it. The patch is committed across multiple stable branches, including 115a5266749d, 50879a3c1faf, 67cb119d32f3, 8f5857be99f1, dfc8292a1d67, and ea3af09eb87d.

Attack Vector

Exploitation requires local access with low-privilege code execution on the target host. An attacker triggers cgroup writeback teardown paths that exercise cgwb_release_workfn() while another task drives the final CSS reference release. The race window is narrow, but a reproducer published by the reporter demonstrates reliable triggering when timing is widened with an injected msleep(100). See the reproducer script for technical details. Successful exploitation can corrupt kernel slab memory, enabling denial of service or privilege escalation depending on heap-grooming techniques.

Detection Methods for CVE-2026-31586

Indicators of Compromise

KASAN reports containing slab-use-after-free in blkcg_unpin_online in kernel logs
Kernel oops or panic with call traces including cgwb_release_workfn and process_scheduled_works
Unexplained kernel crashes on hosts running container or cgroup-heavy workloads
Sporadic writeback workqueue task termination under the cgwb_release workqueue

Detection Strategies

Enable KASAN on test and staging kernels to surface the use-after-free deterministically
Monitor dmesg and /var/log/kern.log for BUG: KASAN entries referencing blkcg_unpin_online or cgwb_release_workfn
Correlate kernel crash dumps and kdump artifacts referencing block/blk-cgroup.c:1367
Audit installed kernel package versions against vendor advisories listing the fixing commits

Monitoring Recommendations

Forward kernel ring buffer events to a centralized log pipeline for anomaly detection
Alert on kernel panics, oops, and workqueue stalls on production Linux fleet hosts
Track kernel package versions across the fleet and flag hosts not patched against CVE-2026-31586
Monitor for unexpected reboots or workqueue worker thread terminations on container hosts

How to Mitigate CVE-2026-31586

Immediate Actions Required

Apply the upstream stable kernel patches that reorder blkcg_unpin_online() to execute before css_put() in cgwb_release_workfn()
Update to kernel packages provided by your Linux distribution that include commits 115a5266749d, 50879a3c1faf, 67cb119d32f3, 8f5857be99f1, dfc8292a1d67, or ea3af09eb87d
Prioritize patching multi-tenant hosts and container platforms where untrusted local code can execute
Restrict local shell access on critical systems until kernels are updated

Patch Information

The fix is available in upstream Linux stable branches. Refer to the official commits: 115a5266749d, 50879a3c1faf, 67cb119d32f3, 8f5857be99f1, dfc8292a1d67, and ea3af09eb87d. Distribution vendors typically backport the fix into long-term support kernels.

Workarounds

No reliable runtime workaround exists; the race is internal to kernel reference counting
Limit untrusted local users and tighten container escape hardening (seccomp, user namespaces, restricted capabilities)
Reduce exposure by disabling unnecessary cgroup writeback features where operationally feasible
Enforce least-privilege execution on shared hosts to limit who can trigger writeback teardown paths

bash

# Verify running kernel and confirm patch presence
uname -r

# Debian/Ubuntu: update kernel package
sudo apt update && sudo apt upgrade linux-image-$(uname -r | sed 's/-generic//')

# RHEL/CentOS/Fedora: update kernel package
sudo dnf update kernel

# Reboot to load the patched kernel
sudo reboot

# After reboot, verify no KASAN reports for blkcg_unpin_online
sudo dmesg | grep -i 'blkcg_unpin_online\|cgwb_release'