CVE-2026-23224: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23224 is a use-after-free (UAF) vulnerability in the Linux kernel's EROFS (Enhanced Read-Only File System) subsystem, specifically affecting file-backed mounts configured with the directio mount option. The flaw was disclosed on February 18, 2026, and affects Linux kernel versions 6.12.x before 6.12.72, 6.13.x through 6.18.x before 6.18.11, and 6.19.x before 6.19.1. Microsoft's Azure Linux 3 kernel (azl3_kernel_6.6.121.1-1) is also listed as a vulnerable product. It carries a CVSS v3.1 base score of 7.8 (High) (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability is classified as CWE-416 (Use After Free) and stems from a race condition between two concurrent execution paths in the EROFS direct I/O subsystem: the I/O completion handler (erofs_fileio_ki_complete) running in the s_dio_done_wq workqueue and the submit function (erofs_fileio_rq_submit). When EROFS performs direct I/O on a file-backed mount, iomap_dio_rw submits a bio and returns -EIOCBQUEUED; the completion handler then calls kfree(rq), freeing the iocb structure. Subsequently, erofs_fileio_rq_submit accesses the already-freed iocb.ki_filp field via file_accessed(), resulting in a NULL pointer dereference and kernel panic. The fix introduces reference counting (initialized to 2) in struct erofs_fileio_rq so that the last of the two paths to decrement the count to zero is responsible for freeing the structure (Red Hat Bugzilla, Kernel Patch).

Successful exploitation causes a kernel panic and system crash, resulting in a complete denial of service requiring a reboot. The vulnerability affects the availability and integrity of the system (CVSS high impact on both), and confidentiality is also rated high due to the potential for memory disclosure via the UAF condition. The attack is limited to local users with low privileges on systems where EROFS file-backed mounts are configured with the directio option, making it a practical threat in multi-tenant or shared Linux environments (Red Hat Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of reporting. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is very low at approximately 0.017%, reflecting the limited likelihood of near-term exploitation. Exploitation requires local access with low privileges and a specific kernel configuration (EROFS file-backed mount with directio enabled), which constrains the practical attack surface (Red Hat Advisory).

• Logs: Kernel panic messages in /var/log/kern.log or dmesg output containing call traces referencing ext4_file_read_iter, erofs_fileio_rq_submit, z_erofs_runqueue, z_erofs_read_folio, filemap_fault, do_page_fault, and do_mem_abort.
• Logs: Kernel oops or NULL pointer dereference messages associated with erofs_fileio_ki_complete or file_accessed in system logs.
• System Behavior: Unexpected system reboots or kernel panics on systems with EROFS file-backed mounts using the directio mount option.
• File System: Presence of EROFS mounts with directio option verifiable via mount | grep erofs or /proc/mounts.

Update the Linux kernel to a patched version: 6.12.72 or later, 6.18.11 or later, or 6.19.1 or later. Patches are available from the Linux kernel maintainers via multiple commits (1caf50ce4af096d0280d59a31abdd85703cd995c, ae385826840a3c8e09bf38cac90adcd690716f57, b2ee5e4d5446babd23ff7beb4e636be0fb3ea5aa, d741534302f71c511eb0bb670b92eaa7df4a0aec) and from Red Hat and Microsoft for their respective distributions. As a workaround for systems that cannot be immediately patched, disable the directio mount option on all EROFS file-backed mounts and restrict local user access to affected systems (Red Hat Bugzilla, Kernel Patch).