{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-31514", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-03-09T15:48:24.107Z", "datePublished": "2026-04-22T13:54:31.531Z", "dateUpdated": "2026-04-22T13:54:31.531Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-04-22T13:54:31.531Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/fileio.c"], "versions": [{"version": "8d582d65d20bb4796db01b19e86909ad68cb337b", "lessThan": "d1ba7d6b3cd1757b108d7b6856c92ae661d6c323", "status": "affected", "versionType": "git"}, {"version": "e49abde0ffc382a967b24f326d1614ac3bb06a94", "lessThan": "5cf3972c8221abdb1b464a14ccf8103d840b9085", "status": "affected", "versionType": "git"}, {"version": "fe4039034dcdf584afbf763787909e28e92a4927", "lessThan": "5a5f23ef5431639db1ac3a0b274aef3a84cc413c", "status": "affected", "versionType": "git"}, {"version": "bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc", "lessThan": "eade54040384f54b7fb330e4b0975c5734850b3c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["fs/erofs/fileio.c"], "versions": [{"version": "6.12.75", "lessThan": "6.12.80", "status": "affected", "versionType": "semver"}, {"version": "6.18.14", "lessThan": "6.18.21", "status": "affected", "versionType": "semver"}, {"version": "6.19.4", "lessThan": "6.19.11", "status": "affected", "versionType": "semver"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.75", "versionEndExcluding": "6.12.80"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18.14", "versionEndExcluding": "6.18.21"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.19.4", "versionEndExcluding": "6.19.11"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"}, {"url": "https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"}, {"url": "https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"}, {"url": "https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}], "title": "erofs: set fileio bio failed in short read case", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nerofs: set fileio bio failed in short read case\n\nFor file-backed mount, IO requests are handled by vfs_iocb_iter_read().\nHowever, it can be interrupted by SIGKILL, returning the number of\nbytes actually copied. Unused folios in bio are unexpectedly marked\nas uptodate.\n\n vfs_read\n filemap_read\n filemap_get_pages\n filemap_readahead\n erofs_fileio_readahead\n erofs_fileio_rq_submit\n vfs_iocb_iter_read\n filemap_read\n filemap_get_pages <= detect signal\n erofs_fileio_ki_complete <= set all folios uptodate\n\nThis patch addresses this by setting short read bio with an error\ndirectly."}], "id": "CVE-2026-31514", "lastModified": "2026-04-23T16:17:41.280", "metrics": {}, "published": "2026-04-22T14:16:50.810", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5a5f23ef5431639db1ac3a0b274aef3a84cc413c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/5cf3972c8221abdb1b464a14ccf8103d840b9085"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d1ba7d6b3cd1757b108d7b6856c92ae661d6c323"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eade54040384f54b7fb330e4b0975c5734850b3c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: erofs: set fileio bio failed in short read case", "id": "2460656", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2460656"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-364", "details": ["A flaw was found in the Linux kernel's erofs filesystem component. When an input/output (I/O) request for a file-backed mount is interrupted by a SIGKILL signal, the system incorrectly marks unused data blocks as up-to-date. This can lead to data integrity issues or the potential disclosure of stale or incorrect information to a local user."], "name": "CVE-2026-31514", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-04-22T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-31514\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-31514\nhttps://lore.kernel.org/linux-cve-announce/2026042209-CVE-2026-31514-510b@gregkh/T"], "threat_severity": "Low"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[8d582d65d20bb4796db01b19e86909ad68cb337b,d1ba7d6b3cd1757b108d7b6856c92ae661d6c323)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[e49abde0ffc382a967b24f326d1614ac3bb06a94,5cf3972c8221abdb1b464a14ccf8103d840b9085)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[fe4039034dcdf584afbf763787909e28e92a4927,5a5f23ef5431639db1ac3a0b274aef3a84cc413c)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[bc804a8d7e865ef47fb7edcaf5e77d18bf444ebc,eade54040384f54b7fb330e4b0975c5734850b3c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.12.75,6.12.80)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.18.14,6.18.21)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[6.19.4,6.19.11)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-04-22T18:39:31.831028+00:00", "value": {"mitigation_remediation": ["Update the Linux kernel to a version that includes the erofs short\u2011read fix (e.g., apply the patch referenced in the cgit commit URLs).", "Restrict mounting of file\u2011backed erofs filesystems to trusted users and avoid exposing them to untrusted code paths.", "If an immediate upgrade is not possible, isolate the affected filesystem by mounting it read\u2011only or temporarily disabling it while monitoring for anomalous read behavior."], "summary": {"action": "Apply Patch", "impact": "Potential for information disclosure due to incorrect file read behavior"}, "threat_synthesis": {"affected_systems": "All Linux kernel builds that contain the erofs filesystem and do not yet incorporate the recent fix are affected. No specific kernel version was provided; the issue is present in any build where the vfs_iocb_iter_read path and erofs_fileio_readahead logic are unpatched.", "description_and_impact": "This vulnerability arises in the Linux kernel's erofs filesystem when a short read operation is interrupted by a SIGKILL signal. The kernel incorrectly marks unused folios in the bio structure as uptodate, effectively allowing potentially stale or uninitialized data to be returned to the caller. The bug could be leveraged by an attacker to obtain data beyond the requested read boundaries or to influence program flow based on corrupted file data, resulting in information exposure or subtle integrity violations.", "risk_and_exploitability": "The CVSS score and EPSS are currently unavailable, and the bug is not listed in CISA\u2019s KEV catalog. The attack vector is likely local, requiring the ability to mount an erofs filesystem and initiate a read operation that can be interrupted. While the flaw does not provide remote code execution capabilities, its traversal into uninitialized memory may allow privileged local users to read sensitive files or corrupt internal kernel structures. System administrators should treat the risk as moderate, focusing on patch deployment and limiting exposure on untrusted hosts."}}}}, "created": "2026-04-22T18:15:15.246177+00:00", "updated": "2026-04-22T18:45:24.010029+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-788", "CWE-200"]}