CVE-2026-31714: Linux Kernel Memory Leak Vulnerability

CVE-2026-31714 Overview

CVE-2026-31714 is a memory leak vulnerability in the Linux kernel's f2fs (Flash-Friendly File System) implementation. The flaw exists in the f2fs_rename() function within fs/f2fs/namei.c, where a call to f2fs_setup_filename() is not paired with a matching f2fs_free_filename() call. The issue was discovered through syzbot fuzzing, which detected unreferenced kernel memory allocations during rename operations on f2fs volumes. The vulnerability is tracked under CWE-401: Missing Release of Memory after Effective Lifetime.

Critical Impact
Local authenticated users can trigger repeated kernel memory leaks through f2fs rename operations, leading to resource exhaustion and potential denial of service on affected systems.

Affected Products

Linux Kernel (multiple stable branches prior to the fix commits)
Linux Kernel 7.1-rc1 development release
Distributions packaging vulnerable kernel versions with f2fs support enabled

Discovery Timeline

2026-05-01 - CVE-2026-31714 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-31714

Vulnerability Analysis

The vulnerability resides in the f2fs filesystem's rename path. When f2fs_rename() processes a rename operation involving a whiteout entry, it calls f2fs_setup_filename() to prepare an encrypted filename structure. This helper allocates memory via fscrypt_setup_filename(), which uses kmalloc_noprof() to allocate buffers for the encrypted name representation.

The syzbot reproducer triggered a 16-byte unreferenced allocation traceable through slab_alloc_node and __kmalloc_noprof. Because the corresponding f2fs_free_filename() is never invoked on this code path, the allocated memory remains attached to no live reference once the rename returns. Each successful invocation leaks the allocation, allowing an attacker with local filesystem access to exhaust kernel memory through repeated rename operations.

Root Cause

The regression was introduced by commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"). That commit added an additional f2fs_setup_filename() call into the rename flow but did not add a paired cleanup call to release the structure. The fix introduces the missing f2fs_free_filename() invocation so the allocated filename buffer is freed on every code path.

Attack Vector

Exploitation requires local access with permission to perform rename operations on an f2fs-mounted filesystem. An attacker scripts a loop of renameat2() syscalls against files configured to trigger the whiteout/encryption path. Each iteration leaks a small allocation. Sustained execution drains the kernel slab allocator, degrading system performance and ultimately producing a denial-of-service condition. The vulnerability does not enable code execution, privilege escalation, or data disclosure.

No public proof-of-concept exploit beyond the original syzbot reproducer has been published. See the upstream patches: Kernel Git Commit 047c0ae and Kernel Git Commit c78206d.

Detection Methods for CVE-2026-31714

Indicators of Compromise

kmemleak reports referencing fscrypt_setup_filename, f2fs_setup_filename, or f2fs_rename in the allocation backtrace.
Steady growth in kmalloc-16 slab usage visible in /proc/slabinfo without corresponding workload increase.
High-frequency renameat2 syscalls originating from a single low-privilege process.

Detection Strategies

Enable CONFIG_DEBUG_KMEMLEAK on test or staging kernels to surface unreferenced allocations matching the f2fs rename call stack.
Monitor kernel slab statistics over time and alert on anomalous growth in small object caches on hosts using f2fs.
Use auditd rules to log renameat2 syscalls on f2fs mount points and correlate against process and user identity.

Monitoring Recommendations

Track kernel version inventory across Linux fleets and flag hosts running unpatched f2fs-enabled kernels.
Alert on sustained increases in MemAvailable reduction without matching workload metrics on f2fs servers.
Capture kernel ring buffer messages from dmesg referencing kmemleak or unreferenced object for offline analysis.

How to Mitigate CVE-2026-31714

Immediate Actions Required

Identify all Linux hosts using f2fs filesystems and prioritize them for kernel updates.
Apply the upstream stable kernel patches that introduce the missing f2fs_free_filename() call.
Restrict shell and filesystem access on multi-tenant systems to trusted users until patches are deployed.

Patch Information

The issue is resolved across multiple stable trees by the following commits: 047c0ae, 369eb20, 3cf11e6, a76c1ca, and c78206d. Update to a stable kernel release that includes one of these commits and reboot affected systems.

Workarounds

Avoid mounting f2fs filesystems where alternative filesystems such as ext4 or xfs meet workload requirements.
Disable or unload the f2fs kernel module on hosts that do not require it: modprobe -r f2fs.
Apply user resource limits via ulimit and cgroup CPU quotas to slow down attacker-driven rename loops while patches are scheduled.

bash

# Verify whether the running kernel includes the f2fs rename memory-leak fix
uname -r
grep -E 'f2fs_free_filename|f2fs_rename' /proc/kallsyms

# Disable the f2fs module if it is not required on the host
lsmod | grep f2fs
sudo modprobe -r f2fs
echo 'blacklist f2fs' | sudo tee /etc/modprobe.d/disable-f2fs.conf