Use-After-Free Vulnerability in Linux Kernel Affecting F2FS Filesystem

CVE-2026-31702

What is CVE-2026-31702?

A vulnerability has been identified in the Linux kernel related to the F2FS filesystem, specifically in the f2fs_compress_write_end_io function. This issue arises when the page count is decremented to zero, allowing a concurrent unmount operation to proceed and potentially free critical memory structures while they are still in use. This race condition can lead to a use-after-free scenario, where the system attempts to access a memory region that has already been deallocated, creating instability and security concerns for affected systems. The issue has been addressed by rearranging the order of operations to ensure memory access is completed before the page count decrements, thus preventing the race condition from occurring.

References