CVE-2026-31777

The Linux Kernel, the operating system core itself.

Security Fix(es):

In the Linux kernel, the following vulnerability has been resolved:

iomap: Fix possible overflow condition in iomap_write_delalloc_scan

folio_next_index() returns an unsigned long value which left shifted by PAGE_SHIFT could possibly cause an overflow on 32-bit system. Instead use folio_pos(folio) + folio_size(folio), which does this correctly.(CVE-2023-54285)

In the Linux kernel, the following vulnerability has been resolved:

bcache: fix NULL pointer in cache_set_flush()

1. LINE#1794 - LINE#1887 is some codes about function of bch_cache_set_alloc().
2. LINE#2078 - LINE#2142 is some codes about function of register_cache_set().
3. register_cache_set() will call bch_cache_set_alloc() in LINE#2098.

1794 struct cache_set *bch_cache_set_alloc(struct cache_sb *sb) 1795 { ... 1860 if (!(c->devices = kcalloc(c->nr_uuids, sizeof(void *), GFP_KERNEL)) || 1861 mempool_init_slab_pool(&c->search, 32, bch_search_cache) || 1862 mempool_init_kmalloc_pool(&c->bio_meta, 2, 1863 sizeof(struct bbio) + sizeof(struct bio_vec) * 1864 bucket_pages(c)) || 1865 mempool_init_kmalloc_pool(&c->fill_iter, 1, iter_size) || 1866 bioset_init(&c->bio_split, 4, offsetof(struct bbio, bio), 1867 BIOSET_NEED_BVECS|BIOSET_NEED_RESCUER) || 1868 !(c->uuids = alloc_bucket_pages(GFP_KERNEL, c)) || 1869 !(c->moving_gc_wq = alloc_workqueue("bcache_gc", 1870 WQ_MEM_RECLAIM, 0)) || 1871 bch_journal_alloc(c) || 1872 bch_btree_cache_alloc(c) || 1873 bch_open_buckets_alloc(c) || 1874 bch_bset_sort_state_init(&c->sort, ilog2(c->btree_pages))) 1875 goto err; ^^^^^^^^ 1876 ... 1883 return c; 1884 err: 1885 bch_cache_set_unregister(c); ^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1886 return NULL; 1887 } ... 2078 static const char *register_cache_set(struct cache *ca) 2079 { ... 2098 c = bch_cache_set_alloc(&ca->sb); 2099 if (!c) 2100 return err; ^^^^^^^^^^ ... 2128 ca->set = c; 2129 ca->set->cache[ca->sb.nr_this_dev] = ca; ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ... 2138 return NULL; 2139 err: 2140 bch_cache_set_unregister(c); 2141 return err; 2142 }

(1) If LINE#1860 - LINE#1874 is true, then do 'goto err'(LINE#1875) and call bch_cache_set_unregister()(LINE#1885). (2) As (1) return NULL(LINE#1886), LINE#2098 - LINE#2100 would return. (3) As (2) has returned, LINE#2128 - LINE#2129 would do not give the value to c->cache[], it means that c->cache[] is NULL.

LINE#1624 - LINE#1665 is some codes about function of cache_set_flush(). As (1), in LINE#1885 call bch_cache_set_unregister() ---> bch_cache_set_stop() ---> closure_queue() -.-> cache_set_flush() (as below LINE#1624)

1624 static void cache_set_flush(struct closure *cl) 1625 { ... 1654 for_each_cache(ca, c, i) 1655 if (ca->alloc_thread) ^^ 1656 kthread_stop(ca->alloc_thread); ... 1665 }

(4) In LINE#1655 ca is NULL(see (3)) in cache_set_flush() then the kernel crash occurred as below: [ 846.712887] bcache: register_cache() error drbd6: cannot allocate memory [ 846.713242] bcache: register_bcache() error : failed to register device [ 846.713336] bcache: cache_set_free() Cache set 2f84bdc1-498a-4f2f-98a7-01946bf54287 unregistered [ 846.713768] BUG: unable to handle kernel NULL pointer dereference at 00000000000009f8 [ 846.714790] PGD 0 P4D 0 [ 846.715129]…

Root has patched CVE-2026-31777 in the linux package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-31777 in the linux package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-31777 in the linux package for Root:Ubuntu:22.04. Multiple fixed versions available.

Root has patched CVE-2026-31777 in the linux package for Root:Ubuntu:24.04. Multiple fixed versions available.

In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Check the error for index mapping The ctxfi driver blindly assumed a proper value returned from daio_device_index(), but it's not always true. Add a proper error check to deal with the error from the function.

• irqchip: Fix refcount leak in platform_irqchip_probe {CVE-2023-53610}
• IB/hfi1: Fix a memleak in init_credit_return {CVE-2024-26839}
• RDMA/irdma: Fix kernel stack leak in irdma_create_user_ah() {CVE-2026-23335}
• wifi: brcmfmac: validate bsscfg indices in IF events {CVE-2026-43110}
• wifi: rtlwifi: 8192cu: fix tid out of range in rtl92cu_tx_fill_desc() {CVE-2025-71100}
• RDMA/core: always drop device refcount in ib_del_sub_device_and_put() {CVE-2025-71157}
• drm/amdgpu: Fix potential NULL pointer dereference in atomctrl_get_smc_sclk_range_table {CVE-2024-58052}
• ionic: Fix netdev notifier unregister on failure {CVE-2024-56715}
• uio_hv_generic: Fix kernel NULL pointer dereference in hv_uio_rescind {CVE-2024-46739}
• netfilter: xt_tcpmss: check remaining length before reading optlen {CVE-2026-43190}
• usb: typec: altmodes/displayport: do not index invalid pin_assignments {CVE-2025-38391}
• crypto: lib/mpi - Fix unexpected pointer access in mpi_ec_init {CVE-2023-52616}
• eventpoll: defer struct eventpoll free to RCU grace period {CVE-2026-43074}
• wifi: brcmsmac: Fix dma_free_coherent() size {CVE-2026-31661}
• SUNRPC: svcauth_gss: avoid NULL deref on zero length gss_token in gss_read_proxy_verf {CVE-2025-71120}
• netfilter: nf_conntrack_expect: skip expectations in other netns via proc {CVE-2026-31496}
• platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data {CVE-2026-23370}
• crypto: bcm - add error check in the ahash_hmac_init function {CVE-2024-56681}
• nvme-pci: ensure we're polling a polled queue {CVE-2026-31523}
• mmc: vub300: fix NULL-deref on disconnect {CVE-2026-31651}
• kernel/irq/irqdomain.c: fix memory leak with using debugfs_lookup() {CVE-2023-52936}
• ipmi: ipmb: Add check devm_kasprintf() returned value {CVE-2024-58051}
• net: usb: pegasus: fix memory leak in update_eth_regs_async() {CVE-2026-23021}
• ASoC: amd: fix memory leak in acp3x pdm dma ops {CVE-2026-23190}
• udp: Deal with race between UDP socket address change and rehash {CVE-2024-57974}
• team: avoid NETDEV_CHANGEMTU event when unregistering slave {CVE-2026-43234}
• tcp: secure_seq: add back ports to TS offset {CVE-2026-23247}
• udp: Fix wildcard bind conflict check when using hash2 {CVE-2026-31503}
• netfilter: nft_set_pipapo: prevent overflow in lookup table allocation {CVE-2025-38162}
• rxrpc: Fix recv-recv race of completed call {CVE-2025-38524}
• netfilter: nf_tables: reject duplicate device on updates {CVE-2025-38678}
• nf_tables: nft_dynset: fix possible stateful expression memleak in error path {CVE-2026-23399}
• crypto: af_alg - limit RX SG extraction by receive buffer budget {CVE-2026-31677}
• xfrm: account XFRMA_IF_ID in aevent size calculation {CVE-2026-43107}
• KVM: x86: Load DR6 with guest value only before entering .vcpu_run() loop {CVE-2025-21839}
• perf: Fix sample vs do_exit() {CVE-2025-38424}
• netfilter: nf_tables: avoid chain re-validation if possible {CVE-2025-71160}
• ksm: use range-walk function to jump over holes in scan_get_next_rmap_item {CVE-2025-68211}
• net: vlan: fix VLAN 0 refcount imbalance of toggling filtering during runtime {CVE-2025-38470}
• net: add proper RCU protection to /proc/net/ptype {CVE-2026-23255}
• ALSA: ctxfi: Check the error for index mapping {CVE-2026-31777}
• rseq: Fix segfault on registration when rseq_cs is non-zero {CVE-2025-38067}
• RDMA/core: Don't expose hw_counters outside of init net namespace {CVE-2025-22089}
• net/mlx5e: Don't store mlx5e_priv in mlx5e_dev devlink priv {CVE-2026-22996}
• Input: synaptics - fix crash when enabling pass-through port {CVE-2025-21746}
• wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit {CVE-2026-31579}
• ptp: remove ptp->n_vclocks check logic in ptp_vclock_in_use() {CVE-2025-38305}
• driver core: fix potential NULL pointer dereference in dev_uevent() {CVE-2025-37800}
• dm: fix NULL pointer dereference in __dm_suspend() {CVE-2025-40134}
• net: let net.core.dev_weight always be non-zero {CVE-2025-21806}
• exec:…

• gpiolib: cdev: Set lineevent_state::irq after IRQ register successfully {CVE-2022-48660}
• ipv4: check for NULL idev in ip_route_use_hint() {CVE-2024-36008}
• KEYS: trusted: Do not use WARN when encode fails {CVE-2024-36975}
• Fix userfaultfd_api to return EINVAL as expected {CVE-2024-41027}
• xhci: Fix null pointer dereference when host dies {CVE-2023-52898}
• sctp: sysctl: auth_enable: avoid using current->nsproxy {CVE-2025-21638}
• blk-mq: fix IO hang from sbitmap wakeup race {CVE-2024-26671}
• net: openvswitch: fix flow memory leak in ovs_flow_cmd_new {CVE-2023-52977}
• gpiolib: fix memory leak in gpiochip_setup_dev() {CVE-2022-48975}
• HID: betop: check shape of output reports {CVE-2023-53015}
• mm/swapfile: add cond_resched() in get_swap_pages() {CVE-2023-52932}
• HV: hv_balloon: fix memory leak with using debugfs_lookup() {CVE-2023-52937}
• drm/i915: Fix a memory leak with reused mmap_offset {CVE-2023-53002}
• ptdma: pt_core_execute_cmd() should use spinlock {CVE-2023-53013}
• RDMA/core: Fix ib block iterator counter overflow {CVE-2023-53026}
• Bluetooth: hci_conn: Fix memory leaks {CVE-2023-53018}
• scsi: target: pscsi: Fix bio_put() for error case {CVE-2024-26760}
• sctp: Prevent TOCTOU out-of-bounds write {CVE-2025-40331}
• pnfs/flexfiles: Fix memory leak in nfs4_ff_alloc_deviceid_node() {CVE-2026-23038}
• cpufreq: intel_pstate: Fix object lifecycle issue in update_qos_request() {CVE-2025-40194}
• ALSA: hda/cs8409: Fix possible NULL dereference {CVE-2024-50160}
• nbd: don't allow reconnect after disconnect {CVE-2025-21731}
• openvswitch: fix lockup on tx to unregistering netdev with carrier {CVE-2025-21681}
• ext4: detect invalid INLINE_DATA + EXTENTS flag combination {CVE-2025-40167}
• ext4: xattr: fix null pointer deref in ext4_raw_inode() {CVE-2025-68820}
• net: fix memory leak in skb_segment_list for GRO packets {CVE-2026-22979}
• wifi: brcmfmac: fix crash while sending Action Frames in standalone AP Mode {CVE-2025-40321}
• ipvs: fix ipv4 null-ptr-deref in route error path {CVE-2025-68813}
• ASoC: Intel: bytcr_rt5651: Fix invalid quirk input mapping {CVE-2025-40121}
• i40e: Fix macvlan leak by synchronizing access to mac_filter_hash {CVE-2024-50041}
• net/mlx5e: Fix NULL deref in mlx5e_tir_builder_alloc() {CVE-2024-50000}
• bpf: Fix reference count leak in bpf_prog_test_run_xdp() {CVE-2026-22994}
• xsk: check IFF_UP earlier in Tx path {CVE-2023-53240}
• firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers {CVE-2024-41038}
• virtgpu: don't reset on shutdown {CVE-2025-38064}
• xen/netfront: fix crash when removing device {CVE-2022-48969}
• mptcp: do not fallback when OoO is present {CVE-2024-50185}
• can: j1939: add missing calls in NETDEV_UNREGISTER notification handler {CVE-2025-39925}
• netfilter: nf_tables: remove redundant chain validation on register store {CVE-2025-71160}
• xfs: fix use-after-free in xattr node block inactivation {CVE-2026-43053}
• ext4: fix racy may inline data check in dio write {CVE-2023-52786}
• drm/amdgpu/fence: Fix oops due to non-matching drm_sched init/fini {CVE-2023-52738}
• macsec: fix UAF bug for real_dev {CVE-2022-49390}
• drm/i915/gem: Fix Virtual Memory mapping boundaries calculation {CVE-2024-42259}
• mm/shmem: disable PMD-sized page cache if needed {CVE-2024-42241}
• driver: iio: add missing checks on iio_info's callback access {CVE-2024-46715}
• udmabuf: fix memory leak on last export_udmabuf() error path {CVE-2024-56712}
• ALSA: control: Avoid WARN() for symlink errors {CVE-2024-56657}
• mm/mempolicy: fix migrate_to_node() assuming there is at least one VMA in a MM {CVE-2024-56611}
• eth: bnxt: always recalculate features after XDP clearing, fix null-deref {CVE-2025-21682}
• net: annotate data-races around sk->sk_{data_ready,write_space} {CVE-2026-23302}
• udmabuf: change folios array from kmalloc to kvmalloc {CVE-2024-56544}
• RDMA/mlx5: Move events notifier registration to be after device registration {CVE-2024-53224}
• dlm: fix possible lkb_resource…

In the Linux kernel, the following vulnerability has been resolved:

ALSA: ctxfi: Check the error for index mapping

The ctxfi driver blindly assumed a proper value returned from daio_device_index(), but it's not always true. Add a proper error check to deal with the error from the function.