CVE-2026-31455: xfs: stop reclaim before pushing AIL during unmount
In the Linux kernel, the following vulnerability has been resolved:
xfs: stop reclaim before pushing AIL during unmount
The unmount sequence in xfsunmountflushinodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes.
Reorder xfsunmountflushinodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling mreclaimwork because the inodegc worker can re-queue mreclaimwork via xfsinodegcsetreclaimable.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.134.1-2 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1Fixed in 7.2.13-1 - Compensating control
During XFS unmount, stop inodegc and cancel background reclaim before pushing the AIL; stop inodegc before cancelling m_reclaim_work because inodegc can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using an XFS filesystem on an affected Linux kernel are exposed during XFS unmount processing. The listed affected software includes the Linux kernel, Debian linux, and Microsoft azl3 kernel 6.6.130.1-3.
What conditions are required to trigger the vulnerability?
An affected XFS filesystem must be unmounted while background reclaim or inode garbage collection is still running. These workers can modify or free dirty inodes while the unmount path is pushing the active item list (AIL).
What is the operational impact?
The race can cause dirty inodes to be inserted into the AIL during the unmount flush or be aborted and freed concurrently. The provided severity vector rates the impact as high availability impact, with no confidentiality or integrity impact.
What does the fix change?
The fix stops inode garbage collection and cancels background reclaim before pushing the AIL during unmount. It stops inodegc first because that worker can otherwise re-queue the reclaim work.