CVE-2026-31467: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-31467 is a deadlock vulnerability in the Linux kernel's erofs (Enhanced Read-Only File System) subsystem, classified as an improper locking flaw (CWE-667). The vulnerability exists in the bio completion path when operating in process context (e.g., dm-verity), where vm_map_ram() is called with GFP_KERNEL flags, potentially triggering memory swapping I/O that causes submit_bio_wait to deadlock under low memory conditions. It was published on April 22, 2026, and affects Linux kernel versions from 5.13 through multiple stable branches up to 6.19. Patches have been released for stable branches. It carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Red Hat Bugzilla).

The root cause is improper locking (CWE-667) in the erofs bio completion path. When bio completion runs in process context (such as under dm-verity), it directly invokes decompression — bypassing a separate workqueue — and subsequently calls vm_map_ram() with GFP_KERNEL. Under memory pressure, this triggers __alloc_pages_direct_reclaim → shrink_folio_list → __swap_writepage → submit_bio_wait, which deadlocks because bio_list is already non-NULL at that point in the call stack. The fix wraps the affected code path with memalloc_noio_{save,restore}() to prevent I/O-generating memory allocations during bio completion (GitHub Advisory). The vulnerability is related to CAPEC-25 (Forced Deadlock) and CAPEC-26 (Leveraging Race Conditions).

Successful triggering of this vulnerability causes the affected Linux system to hang due to a deadlock in the I/O subsystem, resulting in a complete loss of availability for the affected host. Normal I/O operations cannot complete once the deadlock occurs, potentially requiring a hard reboot to recover. There is no confidentiality or integrity impact — the vulnerability is purely an availability (denial-of-service) issue affecting systems using erofs with dm-verity or similar process-context bio completion paths under memory pressure (GitHub Advisory, Red Hat Bugzilla).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability requires a specific combination of conditions: use of erofs with dm-verity (or similar process-context bio completion), and the system being under significant memory pressure. The EPSS score is approximately 0.024% (very low probability of exploitation in the near term). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (GitHub Advisory).

Patches have been released across multiple Linux kernel stable branches. Administrators should update to the following fixed versions: 5.15.203, 6.1.168, 6.6.131, 6.12.80, 6.18.21, 6.19.11, or 7.0 (final). The fix applies memalloc_noio_{save,restore}() around the erofs bio completion path to prevent GFP_KERNEL allocations from triggering I/O during bio processing. As a temporary workaround until patching is possible, reducing memory pressure on affected systems (e.g., increasing available RAM, reducing swap usage, or avoiding erofs with dm-verity on memory-constrained hosts) can lower the risk of triggering the deadlock (GitHub Advisory, Red Hat Bugzilla).

Red Hat tracked this vulnerability via Bugzilla and assigned a CVSS score, indicating standard triage for a kernel availability issue. Amazon Linux issued advisories (ALAS2023-2026-1646 and ALAS2023-2026-1681) addressing this CVE in their kernel packages. Tenable's Nessus scanner added detection plugins (IDs 309681, 312152, and 313522) for this vulnerability. No significant public researcher commentary or social media discussion has been observed beyond routine vendor patch tracking.