Skip to main content

Linux Kernel CVE-2026-31556

| EUVDEUVD-2026-25449 MEDIUM
2026-04-24 Linux GHSA-v4f5-4j9w-9f24
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
5.5 MEDIUM

Local access and low privileges required to run xfs_scrub; deadlock causes availability loss with no confidentiality or integrity impact.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

6
Analysis Generated
Jul 24, 2026 - 03:13 vuln.today
CVSS changed
Apr 27, 2026 - 20:22 NVD
5.5 (MEDIUM)
Patch released
Apr 27, 2026 - 20:14 nvd
Patch available
Patch available
Apr 24, 2026 - 16:16 EUVD
EUVD ID Assigned
Apr 24, 2026 - 15:00 euvd
EUVD-2026-25449
CVE Published
Apr 24, 2026 - 14:35 nvd
MEDIUM 5.5

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

xfs: scrub: unlock dquot before early return in quota scrub

xchk_quota_item can return early after calling xchk_fblock_process_error. When that helper returns false, the function returned immediately without dropping dq->q_qlock, which can leave the dquot lock held and risk lock leaks or deadlocks in later quota operations.

Fix this by unlocking dq->q_qlock before the early return.

AnalysisAI

Missing lock release in the Linux kernel's XFS quota scrub subsystem allows a local, low-privileged user to trigger a dquot lock leak that can cause deadlocks in subsequent quota operations. The flaw exists in xchk_quota_item, which can exit early after xchk_fblock_process_error without releasing dq->q_qlock. This denial-of-service condition affects kernels from the introducing commit 7d1f0e167a06 through the respective stable branch fix points; no public exploit exists and EPSS is at the 5th percentile, indicating low real-world exploitation probability.

Technical ContextAI

The XFS filesystem (cpe:2.3:a:linux:linux:*) includes an online scrub subsystem (xfs_scrub) that inspects and validates filesystem metadata, including disk quotas. Quota entries (dquots) are protected by a per-dquot mutex, dq->q_qlock. The vulnerable function xchk_quota_item acquires this lock, then calls xchk_fblock_process_error; when that helper signals a non-fatal error and returns false, the code previously returned early without executing the corresponding unlock, creating a lock-leak path. The missing release is a classic CWE-667 (Improper Locking) pattern - no CWE was formally assigned by NVD. The issue is confined to the XFS quota scrub path and does not exist in the standard quota read/write paths.

RemediationAI

Upgrade to a fixed kernel release: Linux 6.12.80, 6.18.21, 6.19.11, or 7.0, each of which contains the one-line fix adding the missing mutex_unlock before the early return in xchk_quota_item. Upstream stable commits are available at https://git.kernel.org/stable/c/e822f535273af0e8968eab7acc0cea0b90dd25af (6.12 series), https://git.kernel.org/stable/c/3b0c3414b308e6822cda90bf99f7eac94d4cca2b, https://git.kernel.org/stable/c/d128fc0c5c2b19224927d4fd2a46c2fe6a1f606f, and https://git.kernel.org/stable/c/268378b6ad20569af0d1957992de1c8b16c6e900. Ubuntu users should apply the update referenced in USN-8567-1. As a compensating control on systems that cannot be patched immediately, disabling or restricting invocation of xfs_scrub (e.g., removing the systemd service unit or revoking CAP_SYS_ADMIN for the scrub binary) eliminates the trigger path entirely; the trade-off is loss of online filesystem consistency checking capability.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Medium
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Availability Extension 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed

Share

CVE-2026-31556 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy