CVE-2026-31702

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

f2fs: fix use-after-free of sbi in f2fs_compress_write_end_io()

In f2fs_compress_write_end_io(), dec_page_count(sbi, type) can bring

the F2FS_WB_CP_DATA counter to zero, unblocking

f2fs_wait_on_all_pages() in f2fs_put_super() on a concurrent unmount

CPU. The unmount path then proceeds to call

f2fs_destroy_page_array_cache(sbi), which destroys

sbi->page_array_slab via kmem_cache_destroy(), and eventually

kfree(sbi). Meanwhile, the bio completion callback is still executing:

when it reaches page_array_free(sbi, ...), it dereferences

sbi->page_array_slab — a destroyed slab cache — to call

kmem_cache_free(), causing a use-after-free.

This is the same class of bug as CVE-2026-23234 (which fixed the

equivalent race in f2fs_write_end_io() in data.c), but in the

compressed writeback completion path that was not covered by that fix.

Fix this by moving dec_page_count() to after page_array_free(), so

that all sbi accesses com

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References