CVE-2026-31589: mm: call ->free_folio() directly in folio_unmap_invalidate()
In the Linux kernel, the following vulnerability has been resolved:
mm: call ->freefolio() directly in foliounmapinvalidate()
We can only call filemapfreefolio() if we have a reference to (or hold a lock on) the mapping. Otherwise, we've already removed the folio from the mapping so it no longer pins the mapping and the mapping can be removed, causing a use-after-free when accessing mapping->aops.
Follow the same pattern as removemapping() and load the freefolio function pointer before dropping the lock on the mapping. That lets us make filemapfreefolio() static as this was the only caller outside filemap.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-31589?
CVE-2026-31589 has a high severity due to its potential impact on memory management in the Linux kernel.
How do I fix CVE-2026-31589?
To fix CVE-2026-31589, ensure that your Linux kernel is updated to version 6.19.14 or later or alternatively to version 7.0.1 or later.
Which versions of the Linux kernel are affected by CVE-2026-31589?
CVE-2026-31589 affects Linux kernel versions between 6.14 and 6.19.14 as well as versions between 7.0 and 7.0.1.
What component is primarily affected by CVE-2026-31589?
CVE-2026-31589 primarily affects the memory management component of the Linux kernel.
Is CVE-2026-31589 a remote vulnerability?
CVE-2026-31589 is not categorized as a remote vulnerability but requires local privilege escalation to exploit.