CVE-2026-31463: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-31463 is a use-after-free vulnerability in the Linux kernel's iomap layer, triggered when the inode block size (i_blkbits) differs from the I/O granularity used during file read operations. The flaw was disclosed on April 22, 2026, and affects Linux kernel versions in the 6.19.x series (before 6.19.11) and 7.0 release candidates (rc1 through rc5). The root cause is an incomplete fix introduced by a prior commit (aa35dd5cbc06) that failed to handle a specific edge case involving folios without an attached ifs structure. It carries a CVSS v3.1 base score of 9.8 (Critical), though this score appears to reflect automated scoring and may not fully account for the local kernel context of exploitation (GitHub Advisory, Red Hat Bugzilla).

The vulnerability is classified under CWE-821 (Incorrect Synchronization) and arises in iomap_read_folio_iter(), where the condition if (*bytes_submitted == folio_len) ctx->cur_folio = NULL; fails to invalidate ctx->cur_folio when I/O is submitted for less than the full folio size in the !ifs (no iomap folio state) case. This leaves a stale pointer to a folio that the I/O helper already owns, and when iomap_read_end() is subsequently called on that folio, it results in an invalid folio access — effectively a use-after-free condition. The fix unconditionally sets ctx->cur_folio = NULL for the !ifs case, regardless of how many bytes were submitted (GitHub Advisory, Red Hat Bugzilla).

Successful exploitation can lead to kernel memory corruption, system crashes (kernel panic), or potential data corruption during file read operations on affected filesystems. The vulnerability is most likely to manifest on systems where filesystems configure block sizes that differ from the I/O granularity, such as certain NFS or block device configurations. While the CVSS score rates confidentiality, integrity, and availability impacts as High, practical exploitation for privilege escalation or data exfiltration would require specific filesystem configurations and likely local access (GitHub Advisory, Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report (Feedly). The EPSS score is approximately 0.018% (0.000180), placing it in a very low probability tier for near-term exploitation. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

Patches have been committed to the upstream Linux kernel stable tree. Affected users should update to Linux kernel 6.19.11 or later for the 6.19.x branch, or apply the fix included in the 7.0 final release. The specific upstream commits addressing this issue are 4a927f670cdb0def226f9f85f42a9f19d9e09c88 and bd71fb3fea9945987053968f028a948997cba8cc. Linux distribution vendors (e.g., Red Hat) are tracking this via their own advisory processes and will release updated kernel packages accordingly (Red Hat Bugzilla, GitHub Advisory).