Cloudanix VulnDB

CVE-2026-23224

High · 7.8

CVSS

7.8

EPSS

0.1%

Published

Feb 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in certain Linux kernels used by cloud servers can let a local user crash the system or take control by mounting a specific type of filesystem with an advanced option.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in EROFS file-backed mounts using the directio option due to a race between bio completion and file_accessed() accessing a freed rq structure.

Why it matters to the business

Kernel panic or potential local privilege escalation on affected Linux systems running EROFS mounts, leading to downtime or compromise of cloud instances using the listed Ubuntu kernels.

How an attack unfolds

An attacker with local access mounts an EROFS filesystem with the directio option, triggers concurrent read operations that race between dio completion freeing the rq and subsequent file_accessed() dereference, achieving UAF for memory corruption.

How to fix it

Upgrade linux-aws-5.15 to 5.15.0-1044.49~20.04.1 or newer and linux-azure-5.15 to 5.15.0-1046.53~20.04.1 or newer on Ubuntu 20.04 LTS systems; reboot after package installation.

How to confirm the fix worked

Confirm kernel version after upgrade matches or exceeds the fixed versions; attempt to reproduce the original panic scenario with directio mounts to verify absence of UAF.

Typical attack path

  1. Obtain local code execution on target system
  2. Create or access EROFS image and mount with directio option
  3. Trigger concurrent file reads to induce the race condition
  4. Exploit freed rq for arbitrary read/write or code execution
  5. Escalate privileges or cause denial of service

How to detect it

Search kernel logs for call traces involving z_erofs_read_folio, erofs_fileio_rq_submit, and ext4_file_read_iter; look for UAF-related panics on systems with EROFS directio mounts.

  • erofs_fileio_rq_submit
  • erofs_fileio_submit_bio
  • z_erofs_runqueue
  • dio_aio_complete_work
  • erofs_fileio_ki_complete

What your security team should do

  • Prioritize patching all affected Ubuntu 20.04 cloud instances within 30 days
  • Audit systems for EROFS mounts using directio option and disable if possible until patched
  • Monitor for kernel oops or panic logs containing erofs_fileio functions

The record

In the Linux kernel, the following vulnerability has been resolved: erofs: fix UAF issue for file-backed mounts w/ directio option [ 9.269940][ T3222] Call trace: [ 9.269948][ T3222] ext4_file_read_iter+0xac/0x108 [ 9.269979][ T3222] vfs_iocb_iter_read+0xac/0x198 [ 9.269993][ T3222] erofs_fileio_rq_submit+0x12c/0x180 [ 9.270008][ T3222] erofs_fileio_submit_bio+0x14/0x24 [ 9.270030][ T3222] z_erofs_runqueue+0x834/0x8ac [ 9.270054][ T3222] z_erofs_read_folio+0x120/0x220 [ 9.270083][ T3222] filemap_read_folio+0x60/0x120 [ 9.270102][ T3222] filemap_fault+0xcac/0x1060 [ 9.270119][ T3222] do_pte_missing+0x2d8/0x1554 [ 9.270131][ T3222] handle_mm_fault+0x5ec/0x70c [ 9.270142][ T3222] do_page_fault+0x178/0x88c [ 9.270167][ T3222] do_translation_fault+0x38/0x54 [ 9.270183][ T3222] do_mem_abort+0x54/0xac [ 9.270208][ T3222] el0_da+0x44/0x7c [ 9.270227][ T3222] el0t_64_sync_handler+0x5c/0xf4 [ 9.270253][ T3222] el0t_64_sync+0x1bc/0x1c0 EROFS may encounter above panic when enabling file-backed mount w/ directio mount option, the root cause is it may suffer UAF in below race condition: - z_erofs_read_folio wq s_dio_done_wq - z_erofs_runqueue - erofs_fileio_submit_bio - erofs_fileio_rq_submit - vfs_iocb_iter_read - ext4_file_read_iter - ext4_dio_read_iter - iomap_dio_rw : bio was submitted and return -EIOCBQUEUED - dio_aio_complete_work - dio_complete - dio->iocb->ki_complete (erofs_fileio_ki_complete()) - kfree(rq) : it frees iocb, iocb.ki_filp can be UAF in file_accessed(). - file_accessed : access NULL file point Introduce a reference count in struct erofs_fileio_rq, and initialize it as two, both erofs_fileio_ki_complete() and erofs_fileio_rq_submit() will decrease reference count, the last one decreasing the reference count to zero will free rq.

Affected packages

Ecosystem Package Introduced Fixed
Linux Kernel 6.12.0 6.12.72
openSUSE:Leap 16.0 dtb-aarch64 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-64kb 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-azure 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-default 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-default-base 0 6.12.0-160000.27.1.160000.2.8
openSUSE:Leap 16.0 kernel-docs 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-kvmsmall 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-obs-build 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-obs-qa 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-rt 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-source 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-syms 0 6.12.0-160000.27.1
openSUSE:Leap 16.0 kernel-zfcpdump 0 6.12.0-160000.27.1
openSUSE:Tumbleweed kernel-source 0 6.19.8-1.1

Related vulnerabilities