CVE-2026-31467: erofs: add GFP_NOIO in the bio completion if needed
erofs: add GFPNOIO in the bio completion if needed
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the erofs bio completion path (e.g., endio), add/ensure GFP_NOIO is used in the completion if needed to prevent I/O deadlock scenarios involving submit_bio_wait hanging on a non-NULL bio_list.
Linux kernel (erofs) bio completion GFP flag = GFP_NOIO - Configuration
When calling vm_map_ram() in the process context for decompression (after the bio completion path), pass GFP_KERNEL so vm_map_ram directly calls into decompression rather than triggering another workqueue context, minimizing scheduling latencies and avoiding the swapping I/O deadlock path.
Linux kernel (vm_map_ram call site for decompression) gfp_t argument to vm_map_ram() = GFP_KERNEL
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31467?
CVE-2026-31467 has a high severity rating of 7.5.
What is CVE-2026-31467 related to?
CVE-2026-31467 is related to a vulnerability in the bio completion path of the Linux kernel's erofs.
How do I fix CVE-2026-31467?
To fix CVE-2026-31467, update the Linux kernel to the latest patched version.
What are the potential impacts of CVE-2026-31467?
CVE-2026-31467 can lead to denial of service due to issues in the decompression process.
Which software versions are affected by CVE-2026-31467?
CVE-2026-31467 affects the Linux kernel and the Microsoft azl3 kernel version 6.6.130.1-3.