CVE-2026-31715

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> f2fs: fix UAF caused by decrementing sbi-&gt;nr_pages[] in f2fs_write_end_io()<br /> <br /> The xfstests case "generic/107" and syzbot have both reported a NULL<br /> pointer dereference.<br /> <br /> The concurrent scenario that triggers the panic is as follows:<br /> <br /> F2FS_WB_CP_DATA write callback umount<br /> - f2fs_write_checkpoint<br /> - f2fs_wait_on_all_pages(sbi, F2FS_WB_CP_DATA)<br /> - blk_mq_end_request<br /> - bio_endio<br /> - f2fs_write_end_io<br /> : dec_page_count(sbi, F2FS_WB_CP_DATA)<br /> : wake_up(&amp;sbi-&gt;cp_wait)<br /> - kill_f2fs_super<br /> - kill_block_super<br /> - f2fs_put_super<br /> : iput(sbi-&gt;node_inode)<br /> : sbi-&gt;node_inode = NULL<br /> : f2fs_in_warm_node_list<br /> - is_node_folio // sbi-&gt;node_inode is NULL and panic<br /> <br /> The root cause is that f2fs_put_super() calls iput(sbi-&gt;node_inode) and<br /> sets sbi-&gt;node_inode to NULL after sbi-&gt;nr_pages[F2FS_WB_CP_DATA] is<br /> decremented to zero. As a result, f2fs_in_warm_node_list() may<br /> dereference a NULL node_inode when checking whether a folio belongs to<br /> the node inode, leading to a panic.<br /> <br /> This patch fixes the issue by calling f2fs_in_warm_node_list() before<br /> decrementing sbi-&gt;nr_pages[F2FS_WB_CP_DATA], thus preventing the<br /> use-after-free condition.