CVE-2026-31580: bcache: fix cached_dev.sb_bio use-after-free and crash
In the Linux kernel, the following vulnerability has been resolved:
bcache: fix cacheddev.sbbio use-after-free and crash
In our production environment, we have received multiple crash reports regarding libceph, which have caught our attention:
[6888366.280350] Call Trace: [6888366.280452] blkupdaterequest+0x14e/0x370 [6888366.280561] blkmqendrequest+0x1a/0x130 [6888366.280671] rbdimghandlerequest+0x1a0/0x1b0 [rbd] [6888366.280792] rbdobjhandlerequest+0x32/0x40 [rbd] [6888366.280903] completerequest+0x22/0x70 [libceph] [6888366.281032] osddispatch+0x15e/0xb40 [libceph] [6888366.281164] ? inetrecvmsg+0x5b/0xd0 [6888366.281272] ? cephtcprecvmsg+0x6f/0xa0 [libceph] [6888366.281405] cephconprocessmessage+0x79/0x140 [libceph] [6888366.281534] cephconv1tryread+0x5d7/0xf30 [libceph] [6888366.281661] cephconworkfn+0x329/0x680 [libceph]
After analyzing the coredump file, we found that the address of dc->sbbio has been freed. We know that cacheddev is only freed when it is stopped.
Since sbbio is a part of struct cacheddev, rather than an alloc every time. If the device is stopped while writing to the superblock, the released address will be accessed at endio.
This patch hopes to wait for sbwrite to complete in cacheddevfree.
It should be noted that we analyzed the cause of the problem, then tell all details to the QWEN and adopted the modifications it made.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch bcache: fix cached_dev.sb_bio use-after-free and crash - Compensating control
Avoid stopping or freeing cached_dev devices while a superblock (sb_bio) write is in progress; ensure superblock writes complete before stopping the device (i.e., quiesce or delay cached_dev shutdown until sb_write has finished) as a temporary mitigation until the patch is applied.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Systems using the Linux kernel bcache subsystem with cached devices are exposed when a cached device can be stopped while its superblock is being written. The reported crashes involved libceph and rbd request handling, but the described flaw is in bcache cached-device shutdown and superblock I/O.
What level of access does an attacker need?
The CVSS vector indicates local access and low privileges are required, with no user interaction. Exploitation also depends on being able to trigger the affected bcache device-stop and superblock-write race.
What is the impact if the race is triggered?
The use-after-free can cause a kernel crash. The assigned CVSS vector rates confidentiality, integrity, and availability impacts as high.
How can I determine whether a system may be affected?
Investigate kernel crashes or coredumps involving bcache cached_dev.sb_bio, particularly where a cached device was stopped while a superblock write was in progress. The supplied crash evidence may also include block-layer, rbd, and libceph call-trace frames.
What should be done if patching cannot happen immediately?
Avoid stopping bcache cached devices while superblock writes may be active, since that concurrency condition is described as the cause of the freed sb_bio address being accessed. Monitor affected hosts for kernel crashes during cached-device shutdown operations.