CVE-2026-31586

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

mm: blk-cgroup: fix use-after-free in cgwb_release_workfn()

cgwb_release_workfn() calls css_put(wb->blkcg_css) and then later accesses

wb->blkcg_css again via blkcg_unpin_online(). If css_put() drops the last

reference, the blkcg can be freed asynchronously (css_free_rwork_fn ->

blkcg_css_free -> kfree) before blkcg_unpin_online() dereferences the

pointer to access blkcg->online_pin, resulting in a use-after-free:

BUG: KASAN: slab-use-after-free in blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 ./include/linux/refcount.h:389 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 block/blk-cgroup.c:1367)

Write of size 4 at addr ff11000117aa6160 by task kworker/71:1/531

Workqueue: cgwb_release cgwb_release_workfn

Call Trace:

<TASK>

blkcg_unpin_online (./include/linux/instrumented.h:112 ./include/linux/atomic/atomic-instrumented.h:400 .

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References