PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-31455 Linux CVE debrief

A vulnerability has been resolved in the Linux kernel, specifically in the xfs module. The vulnerability is related to the unmount sequence in xfs_unmount_flush_inodes(), where the AIL (Active Inode List) is pushed while background reclaim and inodegc are still running. This can cause issues as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.

Vendor
Linux
Product
Unknown
CVSS
HIGH 7.8
CISA KEV
Not listed in stored evidence
Original CVE published
2026-04-22
Original CVE updated
2026-06-05
Advisory published
2026-04-22
Advisory updated
2026-06-05

Who should care

Users of Linux kernel versions 5.9 to 7.0 (rc5) should be aware of this vulnerability. Specifically, versions 5.9 to 5.10.253, 5.11 to 5.15.203, 5.16 to 6.1.168, 6.2 to 6.6.131, 6.7 to 6.12.80, 6.13 to 6.18.21, and 6.19 to 6.19.11 are affected.

Technical summary

The vulnerability has a CVSS score of 7.8 and is classified as HIGH severity. The CVSS vector is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The weakness is classified as CWE-416.

Defensive priority

HIGH

Recommended defensive actions

  • Apply the patches provided by the Linux kernel maintainers. The patches can be found at the following links:
  • Upgrade to a Linux kernel version that has the fix applied.

Evidence notes

The vulnerability was published on 2026-04-22T14:16:40.013Z and modified on 2026-06-05T17:47:32.343Z.

Official resources

public