CVE-2026-31455None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still ru…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop reclaim before pushing AIL during unmount
The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < e6cc490048f78b009259a5f032acead9f789c34cLinux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < 239d734c00644072862fa833805c4471573b1445Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < bda27fc0b4eb3a425d9a18475c4cb94fbe862c60Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < d38135af04a3ad8a585c899d176efc8e97853115Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < a89434a6188d8430ea31120da96e3e4cefb58686Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < 8147e304d7d32fd5c3e943babc296ce2873dc279Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < 558e3275d8a3b101be18a7fe7d1634053e9d9b07Linux >= 90c60e16401248a4900f3f9387f563d0178dcf34 < 4f24a767e3d64a5f58c595b5c29b6063a201f1e3Linux 5.9Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses