PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31455 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel, specifically in the xfs module. The vulnerability is related to the unmount sequence in xfs_unmount_flush_inodes(), where the AIL (Active Inode List) is pushed while background reclaim and inodegc are still running. This can cause issues as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-06-05
Advisory published
2026-04-22
Advisory updated
2026-06-05

Who should care

Users of Linux kernel versions 5.9 to 7.0 (rc5) should be aware of this vulnerability. Specifically, versions 5.9 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, and 6.19 to 6.19.11 are affected.

Technical summary

The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as CWE-416.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers. The patches can be found at the following links:
  • Upgrade to a Linux kernel version that has the fix applied.

Evidence notes

The vulnerability was published on 2026-04-22T14:16:40.013Z and modified on 2026-06-05T17:47:32.343Z.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-31455 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-31455

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-31455 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-31455

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/239d734c00644072862fa833805c4471573b1445

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/4f24a767e3d64a5f58c595b5c29b6063a201f1e3

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/558e3275d8a3b101be18a7fe7d1634053e9d9b07

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/8147e304d7d32fd5c3e943babc296ce2873dc279

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/a89434a6188d8430ea31120da96e3e4cefb58686

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/bda27fc0b4eb3a425d9a18475c4cb94fbe862c60

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

  • Mitigation or vendor reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/d38135af04a3ad8a585c899d176efc8e97853115

    416baaa9-dc9f-4396-8d5f-8c081fb06d67 - Patch

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.