CVE-2026-31702

What it actually does

This is a Linux kernel use-after-free in the F2FS compressed writeback completion path. A race can occur between compressed write I/O completion and unmount: the completion callback decrements an F2FS writeback page counter early, which can unblock concurrent filesystem teardown while the callback still holds and later dereferences the F2FS superblock information structure. If the unmount path destroys the page-array slab cache and frees the superblock state before the callback finishes, the callback may access freed kernel memory. Because the flaw is in kernel context, successful exploitation could lead to kernel crash, memory corruption, or potentially local privilege escalation, depending on kernel configuration, heap state, and exploit reliability.

Why it matters to the business

Systems using the Linux kernel with F2FS, especially where F2FS compression and mount/unmount activity are possible, may be exposed to local denial of service or privilege escalation by a user or workload that can interact with an affected F2FS filesystem. The CVSS score is high, but the exposure is constrained by local access requirements and the need for F2FS compressed writeback conditions. EPSS is currently very low, has shown no upward trend over 30 days, and this issue is not listed in CISA KEV or associated with ransomware campaigns, so remediation should be prioritized based on F2FS usage and local multi-user or container-host risk rather than internet-scale exploitation urgency.

How an attack unfolds

An attacker first needs local code execution or another way to trigger filesystem operations on an affected Linux system. They then target an F2FS filesystem using compression and generate compressed writeback activity. While I/O completion is occurring, they attempt to induce a race with unmount or filesystem teardown. In the vulnerable sequence, the writeback completion path decrements a counter that allows the unmount path to proceed, after which teardown can destroy F2FS allocation structures and free the superblock-private state. The still-running completion callback can then dereference the freed state when freeing the page array, causing kernel memory corruption or a crash. A practical exploit would require reliable timing and heap shaping; no public exploit maturity is indicated in the provided data.

How to fix it

Apply a Linux kernel update from the relevant distribution or kernel vendor that includes the F2FS fix for the compressed writeback completion race. The corrective change ensures page_array_free() completes before dec_page_count() can unblock unmount, keeping the F2FS superblock state alive until the callback has finished using it. No exact fixed package versions were provided, so track vendor advisories for the affected kernel streams in use. Where immediate patching is not possible, reduce exposure by avoiding F2FS for untrusted workloads, disabling or avoiding F2FS compression where operationally feasible, preventing unprivileged users or containers from mounting/unmounting F2FS filesystems, and restricting access to removable or loopback-backed F2FS media. Reboot into the patched kernel after installation; merely installing kernel packages is not sufficient if the running kernel remains vulnerable.

How to confirm the fix worked

Confirm the running kernel, not just the installed package, has been updated to a vendor build containing the F2FS compressed writeback completion fix. Inventory systems for F2FS usage by checking mounted filesystems, filesystem images, removable media workflows, and kernel configuration support for F2FS. Validate that untrusted users cannot mount F2FS filesystems unless explicitly required. After remediation, verify systems have rebooted into the patched kernel and monitor for absence of new kernel warnings or crashes referencing f2fs_compress_write_end_io(), page_array_free(), kmem_cache_free(), f2fs_put_super(), or f2fs_destroy_page_array_cache during F2FS compression and unmount testing. For source-built kernels, confirm the patch ordering moves dec_page_count() after page_array_free() in the last-folio compressed writeback completion path.

Typical attack path

1. Obtain local execution on a system running an affected Linux kernel.
2. Identify or create access to an F2FS filesystem where compressed writes can be triggered.
3. Generate compressed writeback activity to enter the vulnerable f2fs_compress_write_end_io() completion path.
4. Race the writeback completion path against unmount or filesystem teardown.
5. Cause the F2FS superblock-private state or page-array slab cache to be destroyed while the completion callback is still executing.
6. Trigger a use-after-free when the callback later accesses the freed F2FS state.
7. Leverage the resulting condition for denial of service or, with sufficient exploit reliability, possible kernel-level privilege escalation.

How to detect it

Look for evidence of attempted or successful exploitation in kernel logs and crash artifacts rather than application logs. Relevant sources include dmesg, journald kernel messages, /var/log/kern.log, /var/log/messages, crash dumps, kdump/vmcore analysis, panic reports, hypervisor console logs, and endpoint telemetry that captures kernel oops events. Search for kernel warnings, BUG/Oops, KASAN use-after-free reports, slab allocator errors, or panics involving F2FS compressed writeback, unmount, kmem_cache_free(), page_array_free(), f2fs_compress_write_end_io(), f2fs_put_super(), or f2fs_destroy_page_array_cache. Correlate crashes with recent mount/umount activity, loop device use, removable media insertion, container workloads with filesystem privileges, and high-volume writes to compressed F2FS filesystems. There are no known network indicators because exploitation is local and filesystem-driven. Absence of these logs does not prove non-exploitation, as a successful privilege escalation may not leave a distinctive artifact beyond abnormal kernel behavior.

• f2fs_compress_write_end_io
• page_array_free
• f2fs_put_super
• f2fs_destroy_page_array_cache
• kmem_cache_free
• KASAN: use-after-free
• BUG: KASAN: use-after-free
• BUG: unable to handle kernel paging request
• general protection fault
• kernel BUG at fs/f2fs
• F2FS-fs
• F2FS_WB_CP_DATA
• page_array_slab
• Call Trace: f2fs_compress_write_end_io
• Call Trace: page_array_free
• Call Trace: kmem_cache_free

What your security team should do

• Prioritize patching Linux systems that use F2FS, permit local shell access by multiple users, run untrusted containers, process removable media, or allow loopback/user-controlled filesystem images.
• Inventory F2FS usage across fleets, including mounted filesystems, embedded devices, Android-derived systems, appliances, and workloads that use flash-optimized filesystems.
• Ensure kernel updates are followed by reboots or live-patch validation where supported; confirm the active kernel is the fixed build.
• Temporarily restrict unprivileged mounting and unmounting of F2FS filesystems, especially from containers, user namespaces, removable media, and loop devices.
• If F2FS compression is not required, disable or avoid it until patched on systems with local untrusted users.
• Add monitoring for kernel oops, panic, KASAN, slab, and F2FS error messages that reference the affected code paths.
• Treat suspicious crashes in F2FS compressed writeback during unmount as potential exploitation attempts, especially on shared systems.
• Because EPSS is low, flat, and there is no KEV listing, prioritize based on actual F2FS exposure rather than broad emergency response.