CVE-2026-31455
xfs: stop reclaim before pushing AIL during unmount
Reported by linux · Published April 22, 2026
In the Linux kernel, the following vulnerability has been resolved: xfs: stop reclaim before pushing AIL during unmount The unmount sequence in xfs_unmount_flush_inodes() pushed the AIL while background reclaim and inodegc are still running. This is broken independently of any use-after-free issues - background reclaim and inodegc should not be running while the AIL is being pushed during unmount, as inodegc can dirty and insert inodes into the AIL during the flush, and background reclaim can race to abort and free dirty inodes. Reorder xfs_unmount_flush_inodes() to stop inodegc and cancel background reclaim before pushing the AIL. Stop inodegc before cancelling m_reclaim_work because the inodegc worker can re-queue m_reclaim_work via xfs_inodegc_set_reclaimable.
EPSS 0.13% · 2.2th percentile
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| kernel6.12-modules-extra-common | Amazon Linux | 1:6.12.80-105.147.amzn2023 |
| kernel6.12-libbpf | Amazon Linux | 1:6.12.80-105.147.amzn2023 |
| kernel6.18 | Amazon Linux | 1:6.18.25-52.107.amzn2023 |
| bpftool | Amazon Linux | 1:6.1.168-202.320.amzn2023 |
| kernel-libbpf-static | Amazon Linux | 1:6.1.168-202.320.amzn2023 |
| kernel-livepatch-6.18.25-52.107 | Amazon Linux | 1:1.0-0.amzn2023 |
| Linux | Linux | e6cc490048f78b009259a5f032acead9f789c34c, bda27fc0b4eb3a425d9a18475c4cb94fbe862c60 |
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux | 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34 |
| Linux | Linux | 5.9, 0, 5.10.253 |
| amazon:2023 | kernel6.12-modules-extra-common | 0 |
| amazon:2023 | kernel6.12-libbpf | 0 |
| amazon:2023 | kernel6.18 | 0 |
| amazon:2023 | bpftool | 0 |
| amazon:2023 | kernel-libbpf-static | 0 |
| amazon:2023 | kernel-livepatch-6.18.25-52.107 | 0 |
| Linux | Linux | 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34, 90c60e16401248a4900f3f9387f563d0178dcf34 |
| amazon:2023 | kernel6.12-tools | 0 |
| amazon:2023 | python3-perf6.18 | 0 |
| amazon:2023 | python3-perf6.12 | 0 |
| amazon:2023 | perf6.18 | 0 |
| amazon:2023 | kernel-headers | 0 |
| amazon:2023 | kernel6.12 | 0 |
| amazon:2023 | kernel6.12-libbpf-static | 0 |
| amazon:2023 | kernel-libbpf | 0 |
| amazon:2023 | kernel-livepatch-6.12.80-105.147 | 0 |
| amazon:2023 | bpftool6.12 | 0 |
| amazon:2023 | kernel6.12-devel | 0 |
…and 23 more
Timeline
- Apr 22, 2026 CVE Published
- Apr 23, 2026 Security Advisory (97 in total, the first dated here)
- May 18, 2026 EPSS Score (25 in total, the first dated here)
- Jul 16, 2026 Coalition ESS Score
- Aug 11, 2026 Distribution Patch (92 in total, the first dated here)
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2026-31455
vulnetix vdb fixes CVE-2026-31455Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2026-31455/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart