CVE-2026-31446

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ext4: fix use-after-free in update_super_work when racing with umount

Commit b98535d09179 ("ext4: fix bug_on in start_this_handle during umount

filesystem") moved ext4_unregister_sysfs() before flushing s_sb_upd_work

to prevent new error work from being queued via /proc/fs/ext4/xx/mb_groups

reads during unmount. However, this introduced a use-after-free because

update_super_work calls ext4_notify_error_sysfs() -> sysfs_notify() which

accesses the kobject's kernfs_node after it has been freed by kobject_del()

in ext4_unregister_sysfs():

update_super_work ext4_put_super

----------------- --------------

ext4_unregister_sysfs(sb)

kobject_del(&sbi->s_kobj)

__kobject_del()

sysfs_remove_dir()

kobj-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References