CVE-2026-31714
Estado: AnalizadaMedia (5.5)—
In the Linux kernel, the following vulnerability has been resolved:
f2fs: fix to avoid memory leak in f2fs_rename()
syzbot reported a f2fs bug as below:
The root cause is in commit 40b2d55e0452 ("f2fs: fix to create selinux label during whiteout initialization"), we added a call to f2fs_setup_filename() without a matching call to f2fs_free_filename(), fix it.
Detalles técnicos trazas, registros y código del informe original
BUG: memory leak
unreferenced object 0xffff888127f70830 (size 16):
comm "syz.0.23", pid 6144, jiffies 4294943712
hex dump (first 16 bytes):
3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff <.Wr[...n..3B9..
backtrace (crc 925f8a80):
kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]
slab_post_alloc_hook mm/slub.c:4520 [inline]
slab_alloc_node mm/slub.c:4844 [inline]
__do_kmalloc_node mm/slub.c:5237 [inline]
__kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250
kmalloc_noprof include/linux/slab.h:954 [inline]
fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364
f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143
f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961
f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308
vfs_rename+0x7ff/0x1250 fs/namei.c:6026
filename_renameat2+0x4f4/0x660 fs/namei.c:6144
__do_sys_renameat2 fs/namei.c:6173 [inline]
__se_sys_renameat2 fs/namei.c:6168 [inline]
__x64_sys_renameat2+0x59/0x80 fs/namei.c:6168
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7fCVSS
- Versión: 3.1
- Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
- Puntuación base: 5.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 0.16%
- Percentil entre todas las CVEs puntuadas: 5
- Fecha de la puntuación: 5/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (1)
CWE
- CWE-401
Referencias
- https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1
- https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003
- https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc
- https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79
- https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e
JSON original (NVD)
Mostrar
{
"id": "CVE-2026-31714",
"cveTags": [],
"metrics": {
"cvssMetricV31": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 5.5,
"attackVector": "LOCAL",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
},
"impactScore": 3.6,
"exploitabilityScore": 1.8
}
]
},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "7525dec4b34c80b3015c3f2ac143fd2bfc1febc3",
"lessThan": "a76c1cad4e80a9802ef8048662255417e3ce5b79",
"versionType": "git"
},
{
"status": "affected",
"version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
"lessThan": "c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e",
"versionType": "git"
},
{
"status": "affected",
"version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
"lessThan": "047c0aef6af37a2a35181aa085c616ad286386f1",
"versionType": "git"
},
{
"status": "affected",
"version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
"lessThan": "369eb2016d8e2f01931b3bad1cb9cefa83f44003",
"versionType": "git"
},
{
"status": "affected",
"version": "40b2d55e045222dd6de2a54a299f682e0f954b03",
"lessThan": "3cf11e6f36c170050c12171dd6fd3142711478fc",
"versionType": "git"
},
{
"status": "affected",
"version": "1d1b89c9846e6a550eca3d2ce9323fb591e4f321",
"versionType": "git"
},
{
"status": "affected",
"version": "64582cc5357cd984724cfb0835b4a34d9c279d31",
"versionType": "git"
},
{
"status": "affected",
"version": "6.6.23",
"lessThan": "6.6.136",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.7.11",
"lessThan": "6.8",
"versionType": "semver"
},
{
"status": "affected",
"version": "6.8.2",
"lessThan": "6.9",
"versionType": "semver"
}
],
"programFiles": [
"fs/f2fs/namei.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "6.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "6.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "6.6.136",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.84",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.25",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.2",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"fs/f2fs/namei.c"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-05-01T14:16:21.493",
"references": [
{
"url": "https://git.kernel.org/stable/c/047c0aef6af37a2a35181aa085c616ad286386f1",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/369eb2016d8e2f01931b3bad1cb9cefa83f44003",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/3cf11e6f36c170050c12171dd6fd3142711478fc",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/a76c1cad4e80a9802ef8048662255417e3ce5b79",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/c78206dcb912ab60b8ee3cbe8c48d749a9a12e1e",
"tags": [
"Patch"
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Analyzed",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-401"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nf2fs: fix to avoid memory leak in f2fs_rename()\n\nsyzbot reported a f2fs bug as below:\n\nBUG: memory leak\nunreferenced object 0xffff888127f70830 (size 16):\n comm \"syz.0.23\", pid 6144, jiffies 4294943712\n hex dump (first 16 bytes):\n 3c af 57 72 5b e6 8f ad 6e 8e fd 33 42 39 03 ff <.Wr[...n..3B9..\n backtrace (crc 925f8a80):\n kmemleak_alloc_recursive include/linux/kmemleak.h:44 [inline]\n slab_post_alloc_hook mm/slub.c:4520 [inline]\n slab_alloc_node mm/slub.c:4844 [inline]\n __do_kmalloc_node mm/slub.c:5237 [inline]\n __kmalloc_noprof+0x3bd/0x560 mm/slub.c:5250\n kmalloc_noprof include/linux/slab.h:954 [inline]\n fscrypt_setup_filename+0x15e/0x3b0 fs/crypto/fname.c:364\n f2fs_setup_filename+0x52/0xb0 fs/f2fs/dir.c:143\n f2fs_rename+0x159/0xca0 fs/f2fs/namei.c:961\n f2fs_rename2+0xd5/0xf20 fs/f2fs/namei.c:1308\n vfs_rename+0x7ff/0x1250 fs/namei.c:6026\n filename_renameat2+0x4f4/0x660 fs/namei.c:6144\n __do_sys_renameat2 fs/namei.c:6173 [inline]\n __se_sys_renameat2 fs/namei.c:6168 [inline]\n __x64_sys_renameat2+0x59/0x80 fs/namei.c:6168\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0xe2/0xf80 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nThe root cause is in commit 40b2d55e0452 (\"f2fs: fix to create selinux\nlabel during whiteout initialization\"), we added a call to\nf2fs_setup_filename() without a matching call to f2fs_free_filename(),\nfix it."
}
],
"lastModified": "2026-06-17T10:34:17.683",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "99A74472-B9EF-4BEF-A3D3-C4A49B46D936",
"versionEndExcluding": "6.6.136",
"versionStartIncluding": "6.6.23"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CD8383BB-B294-4F4D-996D-A780685E6362",
"versionEndExcluding": "6.8",
"versionStartIncluding": "6.7.11"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E9076253-5796-4E04-9AB4-42087B5524F4",
"versionEndExcluding": "6.9",
"versionStartIncluding": "6.8.2"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "E8C01EA7-003E-4236-9C2D-0C2322FB0CE3",
"versionEndExcluding": "6.12.84",
"versionStartIncluding": "6.9"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8B0A7E0E-F6D8-45DB-8CD9-01839FE40A6C",
"versionEndExcluding": "6.18.25",
"versionStartIncluding": "6.13"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1BD58F1E-7C20-4C0D-92A2-FAC5CBFBE8A8",
"versionEndExcluding": "7.0.2",
"versionStartIncluding": "6.19"
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}