CVE-2026-31454

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> xfs: save ailp before dropping the AIL lock in push callbacks<br /> <br /> In xfs_inode_item_push() and xfs_qm_dquot_logitem_push(), the AIL lock<br /> is dropped to perform buffer IO. Once the cluster buffer no longer<br /> protects the log item from reclaim, the log item may be freed by<br /> background reclaim or the dquot shrinker. The subsequent spin_lock()<br /> call dereferences lip-&gt;li_ailp, which is a use-after-free.<br /> <br /> Fix this by saving the ailp pointer in a local variable while the AIL<br /> lock is held and the log item is guaranteed to be valid.